FAST FINISHER OR BUILT TO LAST

MANAGING DATA FOR MUTUAL BENEFIT

As more and more businesses have shifted from the physical to the digital world, consumers have grown comfortable with sharing data about themselves to get the products and services they want. Still, many consumers have done this with only a surface-level understanding of what they’ve agreed to. Recent events, including the 2016 US presidential election, have turned that dynamic on its head. Increasingly, consumers are demanding to know more about what data is getting collected from them, how it’s getting used, and who is accountable if the data gets used for nefarious purposes.

Laws around those issues have proliferated—most notably, the European Union’s General Data protection Regulation (GDPR), which many observers say best embodies the current global standard. The GDPR was one of the first regulations to garner international media attention by including significant consumer protections such as the right to access one’s personal data and the right to be forgotten (the right to request erasure of personal data). In the United States, the California Consumer Privacy Act goes beyond the GDPR in its definition of personal data to include information at the household or device level, as well as data derived from information given to create an individual’s profile that reflects characteristics like a consumer’s preferences, behaviors, aptitudes, and psychology. Those changes have shifted the burden of compliance to private companies—thereby presenting new compliance and risk-management challenges.

“Data privacy has become something that is not just for the lawyers anymore. At LinkedIn... it’s really the responsibility of everybody at the company. As a data-driven company, that’s an important thing for every employee to understand and get a sense of. So, a lot of the work that we do here at LinkedIn is to make sure everyone feels that culture of privacy.”

— Kalinda Raina, Head of Global Privacy and Senior Director, LinkedIn

Born-digital companies can take proactive measures to ease those concerns. Two foundational concepts that are becoming widely adopted by global privacy regulations are minimization and proportionality. Those two tenets assert that companies should collect and retain only the minimum amount of data needed for an intended purpose and that the data collected should be proportional to the scope of services being offered. Data provided for a personal health and wellness app, for example, should be limited to data relevant only to personal general health such as age, gender, and diet and should stop short of collecting a user’s complete medical history. In addition, transparency and disclosure have to be followed, and customers should not be surprised to find out later their personal details got linked to disparate data sets or got used for marketing purposes or got sold to a third party without adequate disclosure and consent.

Clearly, consumers are focusing on those issues, and the stakes are high. Attention-getting examples like the $170-million settlement YouTube reached with the Federal Trade Commission and the New York State attorney general for violating the Children’s Online Privacy Protection Act serve to only increase regulatory pressure and oversight on data privacy issues.

The move from digital ignorance to digital enlightenment presents born-digital businesses with a new imperative: to define a quid pro quo relationship between themselves and their customers regarding data. To meet that imperative, companies will have to (1) establish clear guidelines for ensuring compliance and consistency of operations and (2) define best practices for data collection, use, retention, and sharing.

HOW TO PREPARE FOR THE CHANGING LANDSCAPE

For many born-digital businesses, the work of operationalizing internal processes and ensuring compliance with digital and data regulations may not seem nearly as exciting as driving topline growth by launching hot new products. But companies that embrace this effort can set themselves apart from their less-stringent rivals—including the achievement of a strong return on investment that is gained through savvy risk mitigation.

TAKEAWAYS FOR LEADERS

To start achieving those advantages, born-digital leaders should answer the following simple but crucial questions:

1. What values should define our organization?
2. How will rapid growth affect key elements of our culture, such as whom we hire, what products an services we offer, and where we operate?
3. What commitments can we make to our stakeholder community—customers, employees, investors, regulators—with regard to digital ethics and data privacy?
4. In what areas of digital ethics and data privacy can we anticipate regulatory changes, and how can we proactively design our processes to meet them?
5. What ethical and privacy standards will our customers expect us to adhere to three to five years from now, and how well-positioned are we to meet those expectations?

Born-digital leaders can gain even more valuable insights by encouraging managers and employees, too, throughout their organizations to explore those questions. Such company-wide engagement on the issues can help make sure that everyone understands what’s expected of them and that those who demonstrate the right behaviors get rewarded, not punished.

After all, a company’s culture—like an individual’s character—is defined by the behaviors of executives, managers, employees, and teams when others aren’t watching. When it comes to digital ethics, born-digital enterprises that take the lead on culture, compliance, and data privacy stand the best chance of surmounting the challenges that will inevitably arise from their rapid growth and the disruptions reshaping their industries.

Download the full article

The opinions expressed are those of the author(s) and do not necessarily reflect the views of AlixPartners, LLP, its affiliates, or any of its or their respective other professionals or clients. This article regarding Fast finisher or built to last: How born-digital companies can excel at digital ethics and data privacy (“Article”) was prepared by AlixPartners, LLP (“AlixPartners”) for general information and distribution on a strictly confidential and non-reliance basis. No one in possession of this Article may rely on any portion of this Article. This Article may be based, in whole or in part, on projections or forecasts of future events. A forecast, by its nature, is speculative and includes estimates and assumptions which may prove to be wrong. Actual results may, and frequently do, differ from those projected or forecast. The information in this Article reflects conditions and our views as of this date, all of which are subject to change. We undertake no obligation to update or provide any revisions to the Article. This article is the property of AlixPartners, and neither the article nor any of its contents may be copied, used, or distributed to any third party without the prior written consent of AlixPartners.