Information Management and Governance, Privacy, Uncategorized

HBR and RSA’s Paper on the Impact of GDPR on Business

Earlier this year, the Harvard Business Review published a paper prepared by RSA that discussed the impact of GDPR on business, and how companies can thrive under the rules.

The paper provides advice for companies getting started, and what needs to be in place for them to comply.  It also reflects on the “new normal”, and how companies will have to adopt new practices across the organization in order to remain compliant (e.g., Sales and Marketing will need to collect and maintain opt-in’s for the names on their mailing lists).

The final paragraph says:

Data privacy and security of personal data, then, are likely to become ever higher priorities for government as well as individual corporate customers in the years ahead. At the same time, both government and consumer demands on data—for access, mobility, and analytics—will only increase. This creates a tension, especially for large companies that manage large amounts of data, because “minimization—only collecting what you need and keeping it only as long as you have a legitimate reason—is at odds with innovation,” observes Skivington.

The route to successfully navigating between these two objectives starts with knowing the data you hold and providing notice to all EU data subjects to whom it belongs. The rest follows.

By articulating the opposing tension between the market demands for creative use of data, against the requirements to minimize data collected and retained, RSA correctly highlights one of several ways in which the strategic direction organizations want to pursue (with respect to data use) is increasingly at odds with the rights ascribed to data owners.  They don’t recognize that reconciling these opposing forces is central to the CDO’s responsibility and demonstrates the need to closely align the CDO and CPO.  And while the RSA paper focuses on GDPR and the rights to privacy of individuals, it is clear that the obligations imposed by all data owners will follow the same trajectory – especially as data is increasingly regarded as a leverage-able asset by more and more organizations.

The proverbial trains have left the station – one on the data-as-an-asset track and the other on the data-obligations track.  Both are equally important and must be reflected in the CDO’s vision and strategy.

Contact me at james@jhoward.us

 

Information Management and Governance, Privacy, Uncategorized

Bringing the C’s Together

The Chief Data Officer is in a unique position because they bring together the ever expanding catalog of available information and opportunities to bring value to their organizations. To be effective, they need to look at information objectively, realizing the upside potential, while managing risk and acknowledging their handling responsibilities.

An “I” in PII stands for INFORMATION

The range of information can and should include all the sources that can help achieve the desired objective, including information about people, such as Personally Identifiable Information (PII).  After all, PII is just a class of information, which in many cases can enhance the quality and value of products and services.

But PII is unique in that because it pertains to individuals, it is increasingly subject to a wide range of obligations, whether regulatory, contractual or ethical.  The Chief Privacy Officer is tasked with implementing the policies, procedures and controls around how PII is handled within an organization.

Since the scope of a CPO’s role is to manage compliance for information tied to individuals, and the CDO’s responsibility is around governing and managing the full body of enterprise information, it follows that the CPO responsibility is a subset of the CDO’s responsibility.

Bringing the CDO and CPO together

Traditionally, the CPO sits in the legal and compliance area of organizations, which positions them well to focus objectively on the treatment of the information, looking at it through a legal lense.

In last several years with the rapid growth of data science, there has been a significant refocus on how information is used in organizations, with the increased recognition of the benefit information leverage can bring. Organizations have responded by hiring data scientists and appointing CDO’s located within the business side to focus on leveraging information as an asset.

Having the CDO be organizationally separate from the CPO increases the challenges to have them collaborate, and raises compliance risk. Instead, having the CPO within the Office of the CDO — or even be the same person — provides the opportunity to leverage information with compliance built in, with clear accountability to operational leadership.

Why is this better?

Merging the CDO and the CPO roles provides organizational clarity around the commitment to pursue the opportunities data provides, while highlighting and recognizing the importance of respecting the compliance obligations.  The CDO should be equally conversant in business goals, and the data vision and strategy as they are in the data privacy program.

In addition to the positive optics around emphasizing the importance of privacy, this model embeds privacy in the fabric of operations, not as an after-thought.  It enables the goal of implementing Privacy By Design, and a Privacy Impact Assessment (PIA) becomes a “punctuation mark”, not a major activity.

Checks and balances

To be sure, colleagues (in Risk and General Counsel’s offices) would point out that a benefit of separating the CPO from core business operations is that it helps ensure organizational objectivity and independence, supposedly reducing the chances that privacy requirements can be deprioritized relative to revenue objectives.  But I would argue it happens anyway, in part because the separation raises the risk for privacy to be an afterthought. And implementing privacy requirements as an afterthought (or even just later in a project) greatly reduces the chances of success, while increasing cost and extending timelines.

So there are two key relationships that need to be in place to help ensure the effectiveness of the Privacy program:

  1. Counsel: Privacy is a legal concern, so the CPO/CDO should have a strong relationship and connection to Counsel.  Even the largest organizations rely on outside counsel to supplement the skills of in-house counsel. This is a great idea and should be formalized.
  2. Internal Audit: The CDO/CPO should work with internal audit to make sure data handling is included in the scope of the audit plan.  If there is an ERM (Enterprise Risk Management) plan, data risks and mishaps should figure prominently.

Organizations that are pursuing data leverage, whether as a source of new revenue, or a way to improve products and services or as a way to optimize management decision-making, should consider the significant benefits of merging the data management and privacy capabilities, as it may lead to a stronger – and safer – program, more aligned with the business.

Contact me at james@jhoward.us

CDO, Information Management and Governance

CDO: Leveraging AND Protecting Data

A lot is written about the important role the CDO has in promoting, monetizing and leveraging data in an organization. There is no doubt this is their primary function, and failing to fulfill the role can cost the organization in terms of revenue, competitiveness and market position. But the CDO has an equally important role in overseeing governance of data, and failing to embrace that part can lead to similarly negative outcomes.

I’m going to make a provocative statement: the data leverage market is charging ahead and the data governance disciplines are not keeping up. We will continue to see headlines describing data-related issues. Like opposite ends of a rubber band being pulled tighter and tighter, we are facing an increasing risk of a significant, potentially catastrophic, event. The risks aren’t only that data might lost or breached, but also that the organization might fail to gain full benefit from their data. The CDO plays a key role in managing the risk, avoiding issues, which in turn positions the organization to move faster and more nimbly.

Lets talk about the data:

A majority of companies are leveraging Big Data, with Financial Services and Healthcare leading the charge, and nearly 80% of executives believe that failing to embrace Big Data will cause companies to lose their competitive edge. Use cases range from customer and clickstream analysis, to fraud detection and predictive maintenance. The statistics go on and on, all pointing to an accelerating pace of growth and adoption.

  • Tools are becoming more sophisticated, and evolving to where increasingly, end-users can can pursue data tasks without involvement of IT staff. The analytics software and services market is $42B this year, expected to grow to $103B over the next 9 years.
  • And 59% of executives believe that their use of Big Data would be improved through the use of AI – often itself dependent upon the quality of data.
  • How much data? One estimate puts at 44 zettabytes by 2020 (44 TRILLION gigabytes)!

Point being, we are continuing the trajectory of very high growth in the use of data, and no end in sight as far as how much data there is to manipulate and leverage.

OK. So how is it being managed?

Increasingly, where in place, responsibility to establishing the vision and executing the strategy for data use falls to the Chief Data Officer. However, less that 20% of the top 2,500 companies have named CDOs, and they are often focused on the market-facing and revenue aspects of data. But even for those CDO’s whose responsibilities include governance (covering data protection and quality), there are no standard frameworks to employ to manage data.

By framework, I mean the mechanisms to manage data through it’s lifecycle the way one would manage any other asset. Gartner observes that while the traditional business disciplines provide some analogs to manage information as an asset, nothing has emerged tailored to information, let alone adopted as a standard. In fact, accounting standards don’t even include “information” on financial statements.

Within any governance framework should be Protection against reasonably foreseeable threats. There should be a model where protection of data is proportional to data (asset) value, relevant risks and threats, and which takes into account compliance obligations. To be sure, there are many sets of obligations, supporting methodologies with varying levels of adoption and maturity to address data protection along verticals (e.g., GDPR, HIPAA/HITECH, etc), and respectable frameworks to help ensure information security (ISO27001, for example). But these are rarely within the responsibility scope of the CDO. The CDO has to navigate different organizations to engage with one or more CIOs, CISOs and/or CPOs to help implement protections — and those other leaders’ priorities are often on other imperatives, and politics frequently interfere. So it’s difficult to see how an organization can simultaneously position itself to leverage data as a key asset, while also ensuring proper and proportional protection.

Stepping back looking at the bigger picture, I’m describing a market environment where opportunities for leveraging and profiting from data are exploding, while the mechanisms to manage and protect that data are lagging.

What can go wrong?

This pattern points to scenarios where data is breached, questionable data becomes over relied-upon, or where momentum builds to leverage and profit from data, but due to the lack of proportional governance, an event occurs (or worse, issues go undetected until outsiders raise the alarm) resulting in a loss or process failure, leading to financial and/or brand damage and regulatory intervention. A quick review of headlines reminds us this happens on an all too regular basis, leading to the inevitable questions such as, “how could this have happened?” or “you should have seen that coming”.

Is it avoidable? 

Black swan events are – by definition – unanticipated.  However, organizations can take significant steps to anticipate and either avoid or plan for these events, and prepare for potential outcomes by embracing information management and governance techniques. Remember, a data event – whether a breach or a perceived abuse of data – affects not only the organization in question, but also those around it, emanating outwards.

Data leverage and data management can be thought of as opposing forces pulling opposite ends of a rubber band — they will reach a breaking point, and the tension needs to be released in a controlled fashion. The CDO plays a key role, since they should be looking at the “big picture” of “big data”.

  • The CDO needs to be empowered and adopt a posture that balances pursuit of opportunity with proper governance – protection, quality, accuracy.
  • The CDO should be prominent in an organization, to begin addressing the many cultural barriers to information management.
  • The market needs to settle on a framework to manage information as an asset, recognizing it has value and utility to be exploited.

We are living in a world where data is everywhere and the ability to manipulate it for benefit is growing at an incredible pace. Market disruptions are occurring on a daily basis, often enabled by creative use of technologies that analyze data. Forward looking companies wanting to play in this space are looking to CDOs to help, and they need to be properly enabled. Now is the time to engage.