Executive Leadership – Page 2 – J. Howard, CDO & CPO

Earlier this year, the Harvard Business Review published a paper prepared by RSA that discussed the impact of GDPR on business, and how companies can thrive under the rules.

The paper provides advice for companies getting started, and what needs to be in place for them to comply. It also reflects on the “new normal”, and how companies will have to adopt new practices across the organization in order to remain compliant (e.g., Sales and Marketing will need to collect and maintain opt-in’s for the names on their mailing lists).

The final paragraph says:

Data privacy and security of personal data, then, are likely to become ever higher priorities for government as well as individual corporate customers in the years ahead. At the same time, both government and consumer demands on data—for access, mobility, and analytics—will only increase. This creates a tension, especially for large companies that manage large amounts of data, because “minimization—only collecting what you need and keeping it only as long as you have a legitimate reason—is at odds with innovation,” observes Skivington.

The route to successfully navigating between these two objectives starts with knowing the data you hold and providing notice to all EU data subjects to whom it belongs. The rest follows.

By articulating the opposing tension between the market demands for creative use of data, against the requirements to minimize data collected and retained, RSA correctly highlights one of several ways in which the strategic direction organizations want to pursue (with respect to data use) is increasingly at odds with the rights ascribed to data owners. They don’t recognize that reconciling these opposing forces is central to the CDO’s responsibility and demonstrates the need to closely align the CDO and CPO. And while the RSA paper focuses on GDPR and the rights to privacy of individuals, it is clear that the obligations imposed by all data owners will follow the same trajectory – especially as data is increasingly regarded as a leverage-able asset by more and more organizations.

The proverbial trains have left the station – one on the data-as-an-asset track and the other on the data-obligations track. Both are equally important and must be reflected in the CDO’s vision and strategy.

Contact me at james@jhoward.us

Information Management and Governance, Uncategorized

Role of the CDO in Preserving Client Trust

July 19, 2018September 26, 2018 James Howard

Trust takes years to build, seconds to break and forever to repair

Information in a client relationship:

In today’s business environment, the relationship between organizations and their clients is increasingly multidimensional, whether the clients are individuals, organizations or combinations of the two. And increasingly, a dimension of that relationship involves transacting with information. Consider:

Products or services provided to the client rely, to a greater or lesser degree, on information that is provided by the client, enriched with other sources, or developed organically by the organization,
In the course of providing service, the organization takes in and may retain client information to directly or indirectly enable, enhance or enrich client experience. For example, client account information, CRM data, payment information, loyalty profile information,
In many settings, organizations retain details of transactions for record-keeping purposes, required by regulations or industry standards.
In other settings, information taken in during a transaction contributes to enriching a dataset or training an algorithm, which in turn improves subsequent transactions

An element of client and customer loyalty is the belief in the ongoing usefulness and quality of the products and services, and trust that the organization will not violate the implicit or explicit terms of their relationship.

So what is the CDO’s role in preserving trust?

Data is playing an increasingly prominent role in most organizations’ products and services, whether as net-new data-oriented offerings, or by enriching existing products and services, or helping to optimize internal decision-making and operations. So how does data play into client trust? Three ways..

Data becoming part of products and services:

As data becomes more integral to products and services, it becomes a more important part of the client experience. Depending on the use case, the breadth, depth and range of data used to enrich the product/service will increasingly become a competitive differentiator. Just like the race to add features to on-up the competition, the richness of the data-sets will be used to distinguish one offering from another. For example,

The AI features of a consumer electronic device (enhanced by a richer training data-set),
The relevance and number of true-peer companies represented in a data set used to recommend new or improved business practices,
The number and range of inputs into a cognitive engine used to forecast business trends,
The range of inputs and sensors measuring performance on an industrial device, and the real-time analytics optimizing performance, and
The number of additional data sources used to enrich a dataset licensed to clients, and the ability to adjust quickly.

Data vision describes the ways an organization wants to integrate data into products and services, and the data strategy lays out how the organization plans to get there. The CDO is responsible for coordinating the data vision and ensuring execution of the data strategy including sourcing and managing data through its lifecycle.

So it follows that the more the product or service relies on data to meet client needs, then the more the CDO is key to deliver on those data capabilities. And the more the organization demonstrates the ability to deliver value, the more the client will trust the organization and their brand.

Data quality:

Quality and reliability are central to trust and a client’s desire to engage with an organization. Trust that the quality and reliability will remain is key to maintaining an ongoing relationship. This is true whether at the consumer level, where the transaction involves buying a product, or choosing a doctor or bank, or at the corporate level, buying products or supplies, or engaging an advisor or a BPO.

As the products and services become more dependent on data, issues with quality and integrity of the data can have a greater impact on the product or services, which affects the reputation of the organization and the sustainability of the client relationship. Revisiting the examples from above, consider the following:

What if the AI features of the consumer electronic device can’t respond to queries appropriately, or worse, actions are inconsistent?
What if the datasets used to base business recommendations are outdated, or the reference companies aren’t peers?
What if the data used to train a cognitive algorithm is representative of the business or transactions being modelled?
What of the sensors are tuned for metric units but comparative data is in imperial units? and
What if the organization doesn’t have rights to the data used to enrich a dataset licensed to a client?

Assessing risks to the quality of data starts with a data risk management cycle to understand what can reasonably go wrong, and the impact those events can have on the products/services relying on the data. Flowing from this, an organization should implement a right-sized set of governance and management processes. These not only catalog data with a common ontology and taxonomy, but they track data lineage through its lifecycle from generation/acquisition, through use, and ultimately disposition. Ideally, this overlays all key systems and processes in an organization, but pragmatically, they should prioritize the more impactful data (hence the use of the term “right-sized”).

As the CDO should be the business owner of the data governance and management processes, it follows that properly ensuring the quality of data augmenting client-facing products and services is the CDO’s responsibility. This connects the CDO directly to the trust the clients have in the products and services provided by the organization.

Data protection:

The third leg in a CDO’s stool is data protection. Data used to enhance products and services belongs to someone. And that “someone” generally has an expectation for the protection of their information, expressed through a combination of policies, contracts and regulations.

When a client hands their over information to an organization, they generally do so with the expectation of getting something in return — usually some sort of service or added value. The hallmark of a great business relationship is when the client feels comfortable sharing their most important information – relatively openly and seamlessly – in order to get proportional value in return, without having to worry whether the organization will accidentally or maliciously mishandle the information in any way.

So it follows that in order to ensure the client’s expectations are met with respect to handling of their information, the CDO needs to have a clear understanding of where the information is, what is it being used for, who has access to it, what are the constraints and limitations around its use, and what the client expectations are in the event of misuse/exposure/breach and finally, retention/disposition requirements. The CDO also needs an understanding of the softer elements, meaning, what are the unstated expectations for handling the information that are baked into the relationship with the client, and how can they be met. The CDO converts these to information protection requirements they provide to the CIO, CISO, HR, Physical Security, etc., within their organization.

Failing to treat information in line with requirements and expectations can lead to a variety of consequences, including regulatory fines, brand damage and loss of client trust.

Conclusion:

As relationships between organizations and their clients gets more complex, and involves the transfer of increasingly valuable data, its incumbent on the CDO to understand and help the organization meet client expectations with respect to use, quality and protection of data. In this way, the CDO helps preserve client trust.

Contact me at james@jhoward.us

Information Management and Governance, Information protection, Uncategorized

Data Ethics and the CDO

July 10, 2018September 26, 2018 James Howard

A wise man once told a cheeky arachnid, “With great power comes great responsibility!”

This is a particularly relevant quote in the context of the evolving data economy. CDO’s may think of themselves as caped crusaders saving mankind, and the truth is they are indeed playing an increasingly critical role to help ensure that organizations can successfully transition to their rightful place in the new data economy.

Consider the following:

Overwhelmingly, CEOs believe leveraging data as an asset will be more than a game-changer, and will soon become a critical differentiator to remain successful and relevant – and not all companies will make it;
Available data – both volume and variety – continues to grow at an impressive rate;
Data science and tools are moving in lock-step with the data growth, finding new ways to derive value from data, creating transformative and disruptive opportunities;
Data events – intrusions, breaches and exposures – are also growing at an alarming rate; in 2018 alone, hundreds of millions of people-related records have been targeted, exposed or breached (and that’s just the ones detected); and
Regulators – notably the EU and the State of California – are responding with complicated requirements, that will impact a great majority of organizations, and more jurisdictions will follow.

What is the role of the CDO?

The CDO’s primary responsibility is to establish the vision and execute a strategy to leverage data in a responsible way. This ranges from monetizing data directly, through sale or licensing data, to creating new or enhancing existing products and services with data, to optimizing operations by augmenting decision-making with data. This is a tall order, and needs to combine insights into available opportunities, maturity of the organization to embrace change, and expectations of organizational Leadership with the support they provide. After all, if leadership isn’t on-board, a data program is not likely to be successful.

The other responsibility addresses meeting the obligations tied to the data, which starts with data ethics. Just because we can do certain things with data, should we? Consider some inputs to that decision:

Harm– As with medicine, and as the business person overseeing data initiatives, the CDO should start from the commitment to “do no harm”. The CDO should have a methodology for analyzing and socializing potential data solutions to understand the potential consequential impacts.
Legality– The CDO should collaborate with counsel to develop a clear understanding of where legal boundaries lie. As with “do no harm”, organizations should not break the law. The CDO has an important role, because sometimes there is legal risk (heightened probability that a law will be – or perceived to be – broken), and analysis presented to decision-makers should be clear. As with other cutting edge sciences, senior leadership may not be as data-literate as the CDO or the data scientists.
Expectations– An initiative may be “legal” – technically – and even cause no actual harm, but the organization should be comfortable that stakeholders or clients would not be so disappointed with an outcome that the organization’s brand is impacted or clients go elsewhere. A consumer-client has a different tolerance level than client-companies; consumers take reactionary queues from society, media and social-networks, often with unpredictable results. Client companies have their own stakeholders, regulators and clients to look out for, which drive their reaction. Moreover, an un-harmful but “creepy” initiative may draw unwanted scrutiny from a regulator, resulting in the organization expending resources to address.
Profit – will the initiative make money, even if risks are mitigated and obligations are met, and expectations are intact? A CDO will be presented (pitched?) with dozens of cool ideas, and has to know how to analyze them for fit within the organization. This is trickier than it seems, because data science presents data-oriented opportunities in organizations not used to the data economy. The decision-making process around investing in a new plant or product in, say, a manufacturing company may be very different than deciding to invest in a data-driven feature or capability. And simply “willing it to happen” isn’t enough.
Consequences– Suppose the organization bets wrong. What if the initiative fails to deliver on the planned profit, or simply doesn’t work? This is manageable through various pathways – insurance, hedges, accounting treatment, etc. But what if the organization creates a proverbial monster? Recent debate around AI comes to mind, with AI appearing to evolving in lab settings. What if, in hindsight, the organization realizes they did something deeply wrong or harmful – should they have been expected to anticipate and alter course? Recently, companies have ceased to exist because they pursued what seemed like sanctioned or low-risk data-driven initiatives, failing to anticipate social and political outrage.

The data economy presents opportunities never before available to business. Some organizations will choose to gamble risk against profit. Others will take a step back and forego immediate opportunities, adopting a wait-and-see attitude. Some from each group will succeed while others fail.

Like any new science that affects humanity, data science should adopt a canon of ethics that balances achieving benefit against the risk of harm.

No doubt the CDO plays a central role in making or orchestrating decisions and administering data. As the steward of the data vision and strategy, the CDO must be able to think through the upsides and downsides with balance and objectivity and be willing to stand behind the ethics of decisions, after the fact.

Contact me at james@jhoward.us

Uncategorized

Data Literacy and the CDO

June 29, 2018September 26, 2018 James Howard

I attended a CIO Event in New York today and there was a great session focused on Data Literacy, presented by Jordan Morrow from QlikView.

Simply put, Data Literacy (in a business context) is a person’s ability to read, understand, analyze and communicate data as actionable information, including using data to support an argument or a proposal. Jordan conveyed that only ~20-33% of those surveyed (including senior executives) considered themselves Data Literate. At the same time, 80% of senior executives see leveraging data as an asset will be critical for continued success and growth.

Responsibility for increasing the data literacy falls to the CDO, and should be a high priority, as it is a prerequisite for an organization achieving maturity in the data leverage space, and is a springboard for data innovation.

The benefits are clear. If an organization achieves a higher level of data literacy, they will:

Be able to define a vision that more closely aligns with overall mission
Develop a strategy that aligns with culture and is more implementable and focused on achievable objectives
Distribute the execution across the organization with more stakeholder buy-in
Include data as a basis for decision-making
Improve professional skepticism around quality of data

If people are sensitive to the nature of data, they can be expected to incorporate risk-awareness when deciding how to handle data – for example, knowing they are handling PII may cause them to exercise better judgement around it’s treatment, or ask an SME for guidance.

It’s a tall order, especially given the acknowledged low current state of literacy, but can still be approached in a pragmatic way. There are a number of methodologies out there for increasing Data Literacy that can be adapter to an organization. Here are some thoughts on approach:

The CDO should chair a leadership-level steering committee with representation from all business areas, which sanctions the CDO’s agenda and champions the program;
Data Literacy should be on the agenda as a core element and critical-success-factor;
Steering committee members should become data literate;
Careful thought should go into how the literacy program in rolled out:
- Culture is hard to change (and requires ongoing messaging and overt steering committee/senior leadership support)
- Training triggers eye-rolling, especially if it’s not closely tied to a person’s day to day responsibilities
- Raising literacy is iterative, and should be tied to roll-out of capabilities or products, so awareness and training is relevant and just-in-time.
- Wins should be celebrated.
Since richer datasets might incorporate regulated data, Data Literacy training/awareness should cover appropriate data handling, based the nature of the data. This has the added bonus in that if it’s delivered just-in-time, it will be more relevant to the use-case being introduced.

I came away from the CIO Event reminded that even though CDO responsibilities are growing on the market-facing side (e.g., data monetization), they should also be responsible for ensuring everyone in the organization is realizing the benefits of the “data economy”.

Contact me at james@jhoward.us

Information Management and Governance, Uncategorized

The Case for a Broad Scope CDO

June 24, 2018September 26, 2018 James Howard

Information exists is all forms, spread across organizations, and available throughout the marketplace. Forward-looking organizations are identifying and categorizing information assets with a view to leveraging it – perhaps by enhancing existing products and services, by creating net-new revenue opportunities, optimizing business or financial operations, or to more effectively manage risk.

Treating Information Like an Asset

Like with any asset, and as a responsible business person, the Chief Data Officer (CDO) establishes the vision and goals for information use, and implements strategies to achieve that vision – whether they are monetization, product/service-enhancement or business optimization. As a responsible steward, the CDO governs the information through its lifecycle, and manages risk in a way proportional to the threats, and in consideration of the value of the asset and stakeholder expectations.

Handling techniques are aligned with the nature of the information and take into account the way the business wants to use information;

Depending on how the information is stored, transmitted and processed, threats and vulnerabilities may run the gamut of cyber – from traditional hacking all the way to sophisticated industrial espionage schemes – as well as non-technology based threats, such as physical loss, destruction or theft.

Depending on the nature of the information, it may be subject to a variety of obligations – contractual, GDPR, PCI, HIPAA/HITECH, GLBA, client expectations, etc., many of which include principles-based and/or prescriptive handling requirements, with a wide range of legal, financial, and/or brand damage consequences in the event information is mishandled, lost or breached.

Stepping Back

So taking a step back, we’re describing a business environment where

The market is demanding a greater degree of data use,
Data science is providing ever expanding opportunities, and
The range of vulnerabilities/threats/obligations are more complex than ever.

Everyone seems to be focusing on information, and the opportunities and stakes are huge. Responsible organizations wanting to lead their industries will exploit information assets, meet compliance obligations and manage risks proportionally – and as a result, derive value.

Role of CDO

It is difficult to see how to manage information in a balanced way in a traditional organizational structure where the revenue/leverage focus of information is separate from the protection focus, which is further separate from compliance focus. It would seem unrealistic to expect to be fast-moving, nimble, risk-aware and compliant, if data leverage, protection and compliance are all managed in parallel organizations, often with different success criteria and subject to different measurements.

Organizationally, this suggests building the Office of the CDO by pulling together:

Data vision and strategy: interfacing with senior and business-line leadership, establishing a vision for data use, and defining the strategy to achieve the vision;
Data Governance and Management: designing, building and operating processes and controls for handling information throughout its lifecycle;
Obligations compliance: monitoring and respecting the rules and expectations; and
Information protection: understanding threats and vulnerabilities, and ensuring they are addressed in a proportional way.

Among business trends, information leverage is seen as having the highest potential to deliver maximum value back to organizations. To derive that ROI, the CDO needs to have the organizational authority to influence and/or drive activity across the enterprise, whether it’s to enable existing product lines’ information ambitions, or to cut through organizational politics and roadblocks. To achieve that they need to report to the highest levels of the organization, accountable to the management committee and Board.

Advantages

This model has a host of advantages:

It enables senior-level visibility and buy-in for information-related initiatives,
It focuses talent on exploiting and managing a critical corporate asset as a primary objective,
It forces the protection efforts to operate in a way that’s proportional to the value of the assets being protected, and the risks to which they’re exposed,
It aligns compliance to the way an enterprise wants to use information, and the relevant aspects of the obligations,
It raises the profile and creates focused awareness around the information assets,
It provides for career opportunity and satisfaction for the participants, because they are more closely exposed to the revenue cycle of their employer, and
It aligns investments more closely with objectives and return.

Information is increasingly viewed as the new natural resource. It presents opportunities that can be exploited along with risks that can be managed. And the pace of change is increasing. Organizations should lay the groundwork now to position themselves for the new Information Age.

Contact me at james@jhoward.us