Tag: Data Leverage

CDO, CPO, GDPR, IAPP, Information Management and Governance, Information protection, Privacy

Data Regulation is the New Reality

James Howard

On October 28th, the BBC’s Chris Baraniuk reported that recently, Tim Cook was in Brussels to address the International Conference of Data Protection and Privacy Commissioners.  In his remarks, Mr. Cook, referring to the misuse of “deeply personal” data, said data was being “weaponized against us with military efficiency”.  The BBC went on to report that Mr. Cook said “We shouldn’t sugar-coat the consequences,” and “This is surveillance.”

The speech reaffirmed Apple’s strong defense of user privacy rights, in contrast to competitors business model of driving advertising revenue by analyzing people online habits.   “The trade in personal data served only to enrich the companies that collect it, he added.”

Mr Cook also praised the EU’s new data protection regulation, the General Data Protection Regulation (GDPR), and went on to say that other countries “including my own,” should follow the EU’s lead toward protecting personal data.

To be sure, economics are at the heart of the concern.  Given the string of events that have occured, where data is mishandled or exposed, companies are at risk of losing customer and stakeholder trust, and without that trust, it not clear how they can drive or thrive in the data economy.  So coming together in support of a GDPR-like framework makes sense; it raises the conversation to a global level, and can result in a safer and more efficient environment in which to conduct business. Companies that embrace the framework will have more flexibility and resilience, while those firms paying it lip-service will eventually themselves be at the center of their own data crisis.

And therein lies the rub.  Compliance is not the same as data protection, especially when the regulation is principles-based and not prescriptive.  If the objective in implementing a framework is to comply with a regulation, one is tempted to overlay one’s current operating model with the requirements of the regulation and address gaps.  While it may reduce the risk of data incident, it will probably do so by coincidence.

On the other hand, if companies went about handling information with the strongest possible ethics, where they routinely assessed and addressed risk, recognized and avoided moral hazards, then the incidence of breach and miss-use would naturally be much lower.

The obvious competitive issue is that the second scenario is more expensive and less flexible.  Moreover, if a minority of companies took this approach, they would be less prosperous, and economic darwinism would cause them to go extinct.  And suppose there were a major data “catastrophe”, and the market environment were made up of a combination of those that embrace a high degree of data ethics and those that don’t, the market may not recognize and reward the higher resilience of the highly-ethical-but-less-profitable.  Instead, what we’ve seen is the mainstream market reacts with shock and incredulity and – at the prompting of regulators – implement newly-penned frameworks meant to avoid future occurrences of those events.

While one might argue that black swan events are by definition unforeseeable, one can equally argue that waiting for them to strike before implementing any sort of protection strategy simply opens the door to more black swans, and when events do occur, they result in unnecessarily high impact.

Apple’s Tim Cook makes clear his view that status quo is unacceptable.  As an unquestioned highly credentialed leader and insider in the technology (and information) world, his use of words like “weaponized” and “this is surveillance” should not be taken lightly — he knows what he’s talking about.  No doubt more so than the rest of us.

So as with most things, a thoughtful balance must be considered.  The dilemma is how to balance among the following:

  1. The rapid growth the volume to data aggregated by companies, across the board from business-to-consumers, to business-to-business companies, and ranging from companies providing services to those providing goods — and the increasing overlap.

  2. As a subset of that, the increase in the volume of personal data stored online, and the ability to gather even more data about individuals – habits, interests, locations, views and opinions.

  3. The rapid evolution in the science of data analytics, and the ramp-up of technology able to manipulate and compute data on a mammoth scale.

  4. Coupled with this, is the increasing ability to combine and analyze datasets in ways that allow for the creation of new and credible data and conclusions.

  5. As the size and richness of the datasets grow, so do the consequences of an event (whether a breach, misuse, abuse or exposure).  These range from a sense of creepiness when personal data is exposed, all the way to the very real consequences of insidious manipulation of our views and opinions.

In short, how can companies derive benefit from data, while managing the risks?  Neither momentum is letting up — the momentum around utilizing the expanding datasets, or the momentum around data events and subsequent responses from regulators.

One realistic way is to embrace and build a culture around managing all aspects of data, in lock step.  This is built into a data management program, led by a Chief Data Officer, comprised of three interdependent functions:

  1. Data Leverage, focussed on enabling the business use of information,

  2. Data Protection and Compliance, focussed on addressing risk resulting from data leverage, in terms of misuse, loss or non-compliance with obligations

  3. Data Quality, ensuring that the data being used retains its accuracy and integrity

This model is coupled with appropriate oversight, in the form of:

  1. A steering group with senior stakeholders from across the company,

  2. Direct oversight by CEO or COO,

  3. Connectivity into other key functions, including the CIO, CISO, HR and Legal,

  4. Active oversight by the Board of Directors, to support business initiatives and agree with risk mitigations plans.

A standing filter for any and all data initiatives needs to be ethics, and a consideration for the consequences of the genie getting out of the lamp.  Is the company willing to handle the outcome, if an initiative goes wrong? What is the risk, how is it managed, and are the right people accepting the residual risk?

The discussion is reaching a fever pitch with leaders of the most influential technology companies adding their voices to the conversation.  Any company wanting to join the data economy should consider doing so with an appropriate data management framework. This will position them to accelerate as new opportunities present themselves, while being able to manage events as they occur and accommodate compliance requirements that arise.

 

Information Management and Governance, Uncategorized

Innovation and Data

James Howard

Data Explosion:

As a benefit of advances in technology, the volume and availability of data is increasing exponentially, including the ability to collect rich data as collateral from operational transactions.

Sensors permit the increased gathering of data, some of which can be procured commercially – performance data from jet engines, weather data around seasonal storms, wrist band data from families visiting amusement parks, patient data from medical devices, etc.

Key Advances – enabling data innovation:

Advances in algorithms enable more sophisticated analysis of data – intelligent automation, cognitive –  creating the ability for automation to become more seamlessly integrated into the user experience. Most – if not all – are hugely dependent on the quality and availability of data.

Advances in cloud platforms enable the analysis of larger volumes of data, more opportunistically with on-demand, cost-effective scaling.

Within organizations, data can be classified into the following:

  1. Marketable data– data-oriented products or services that have market value, whether in raw or refined/aggregated form
  2. Management data– KPI information gathered from business systems, used to inform decision makers
  3. Transactional data– information generated from an organizations business activities, whether banking transactions, audits, sales activities or IoT logs
  4. Operational data– Presentations, R&D activities, thought pieces, brochures, client data processed by employees

Opportunities for Innovations:

The evolving discipline of data science is imagining new, innovative and creative ways to combine data, extract “signals” and drive value – whether its from anticipating possible outcomes (mortgage defaults as a function of weather patterns and number of computers), identifying lost revenue (hospital networks providing costly diagnostic services, but losing higher margin treatment revenue), or identifying interesting correlations (consumer buying patterns following summer storms)

Each of the above classifications of data present opportunities for innovation:

  1. Marketable data is the holy grail: with appropriate governance, harvesting and deriving revenue from data available as collateral from business.  Innovation drives things such as, how can the data be refined or enriched to increase value to licensor?  How must it be anonymized to meet regulatory requirements?  How to achieve fair share of downstream revenue?
  2. Enriching management reporting and optimize processes by introducing additional data e.g. road construction plans influencing product delivery routes or performance of local sports teams affecting snack sales;
  3. Transactions can be mined to optimize performance, contribute to regulatory or management reporting and can be refined with robotics and intelligent automation
  4. Operational data can be cataloged, leveraged – avoiding re-creation – and tracked for compliance with regulations or client expectations, or disposal

Contact me at james@jhoward.us

CDO, Information Management and Governance

CDO: Leveraging AND Protecting Data

James Howard

A lot is written about the important role the CDO has in promoting, monetizing and leveraging data in an organization. There is no doubt this is their primary function, and failing to fulfill the role can cost the organization in terms of revenue, competitiveness and market position. But the CDO has an equally important role in overseeing governance of data, and failing to embrace that part can lead to similarly negative outcomes.

I’m going to make a provocative statement: the data leverage market is charging ahead and the data governance disciplines are not keeping up. We will continue to see headlines describing data-related issues. Like opposite ends of a rubber band being pulled tighter and tighter, we are facing an increasing risk of a significant, potentially catastrophic, event. The risks aren’t only that data might lost or breached, but also that the organization might fail to gain full benefit from their data. The CDO plays a key role in managing the risk, avoiding issues, which in turn positions the organization to move faster and more nimbly.

Lets talk about the data:

A majority of companies are leveraging Big Data, with Financial Services and Healthcare leading the charge, and nearly 80% of executives believe that failing to embrace Big Data will cause companies to lose their competitive edge. Use cases range from customer and clickstream analysis, to fraud detection and predictive maintenance. The statistics go on and on, all pointing to an accelerating pace of growth and adoption.

  • Tools are becoming more sophisticated, and evolving to where increasingly, end-users can can pursue data tasks without involvement of IT staff. The analytics software and services market is $42B this year, expected to grow to $103B over the next 9 years.
  • And 59% of executives believe that their use of Big Data would be improved through the use of AI – often itself dependent upon the quality of data.
  • How much data? One estimate puts at 44 zettabytes by 2020 (44 TRILLION gigabytes)!

Point being, we are continuing the trajectory of very high growth in the use of data, and no end in sight as far as how much data there is to manipulate and leverage.

OK. So how is it being managed?

Increasingly, where in place, responsibility to establishing the vision and executing the strategy for data use falls to the Chief Data Officer. However, less that 20% of the top 2,500 companies have named CDOs, and they are often focused on the market-facing and revenue aspects of data. But even for those CDO’s whose responsibilities include governance (covering data protection and quality), there are no standard frameworks to employ to manage data.

By framework, I mean the mechanisms to manage data through it’s lifecycle the way one would manage any other asset. Gartner observes that while the traditional business disciplines provide some analogs to manage information as an asset, nothing has emerged tailored to information, let alone adopted as a standard. In fact, accounting standards don’t even include “information” on financial statements.

Within any governance framework should be Protection against reasonably foreseeable threats. There should be a model where protection of data is proportional to data (asset) value, relevant risks and threats, and which takes into account compliance obligations. To be sure, there are many sets of obligations, supporting methodologies with varying levels of adoption and maturity to address data protection along verticals (e.g., GDPR, HIPAA/HITECH, etc), and respectable frameworks to help ensure information security (ISO27001, for example). But these are rarely within the responsibility scope of the CDO. The CDO has to navigate different organizations to engage with one or more CIOs, CISOs and/or CPOs to help implement protections — and those other leaders’ priorities are often on other imperatives, and politics frequently interfere. So it’s difficult to see how an organization can simultaneously position itself to leverage data as a key asset, while also ensuring proper and proportional protection.

Stepping back looking at the bigger picture, I’m describing a market environment where opportunities for leveraging and profiting from data are exploding, while the mechanisms to manage and protect that data are lagging.

What can go wrong?

This pattern points to scenarios where data is breached, questionable data becomes over relied-upon, or where momentum builds to leverage and profit from data, but due to the lack of proportional governance, an event occurs (or worse, issues go undetected until outsiders raise the alarm) resulting in a loss or process failure, leading to financial and/or brand damage and regulatory intervention. A quick review of headlines reminds us this happens on an all too regular basis, leading to the inevitable questions such as, “how could this have happened?” or “you should have seen that coming”.

Is it avoidable? 

Black swan events are – by definition – unanticipated.  However, organizations can take significant steps to anticipate and either avoid or plan for these events, and prepare for potential outcomes by embracing information management and governance techniques. Remember, a data event – whether a breach or a perceived abuse of data – affects not only the organization in question, but also those around it, emanating outwards.

Data leverage and data management can be thought of as opposing forces pulling opposite ends of a rubber band — they will reach a breaking point, and the tension needs to be released in a controlled fashion. The CDO plays a key role, since they should be looking at the “big picture” of “big data”.

  • The CDO needs to be empowered and adopt a posture that balances pursuit of opportunity with proper governance – protection, quality, accuracy.
  • The CDO should be prominent in an organization, to begin addressing the many cultural barriers to information management.
  • The market needs to settle on a framework to manage information as an asset, recognizing it has value and utility to be exploited.

We are living in a world where data is everywhere and the ability to manipulate it for benefit is growing at an incredible pace. Market disruptions are occurring on a daily basis, often enabled by creative use of technologies that analyze data. Forward looking companies wanting to play in this space are looking to CDOs to help, and they need to be properly enabled. Now is the time to engage.