Organizational Data Competency

Hello everyone and thank you for joining today's webinar. My name is Rhys and I'll be a moderator for today's session. We're going to kick off in a few minutes at the top of the hour. We're just waiting so everyone has a chance to join. In the meanwhile, though, we'd love to hear from you. So let us know where you're joining from using the chat, the comments, depending on what platform you're watching from, and yeah, tell us something that you'd like to get out of today's webinar. We will be having a Q and A at the end of today's session, so if you have any questions that spring to mind, let us know in the chat, in the comments as soon as you think of them. And we will save them for the Q and A as well. If you haven't already, register for the event on datacamp and we will send you the recording as well as any resources we get as well. I put a link to that in the chat, but I'll also be reposting it shortly. So yeah, keep an eye out for that and get registered for it. Brilliant. I'll be back to repeat these messages for any new joiners shortly, but until then, enjoy the background music.

Sam.

Hello everyone and thank you for joining today's webinar. My name is Rhys and I'm going to be your moderator for today's session. We're going to kick off the session in a couple of minutes at the top of the hour. We're just waiting so everyone has a chance to join. Let us know where you're joining from using the chat or the comments, depending on what platform you're watching on. And yeah, tell us something that you'd like to learn in today's webinar. Few bits of housekeeping before we kick off. The session is being recorded and the recording will be emailed to everyone that's registered for the event. If you haven't registered for the event, make sure you go find my comment in the chat and the comments. I'll be reposting it shortly, but it is already there and you can get registered so we can send you the recording and all of the resources as well. We are going to also have a Q and A towards the end of the session, so if you have any questions for Basel today, then let us know as soon as they spring to mind. Pop them in the chat or the comments and I will save them for the Q and A. I'll be back shortly to get us started, but until then, enjoy the background music.

Sam. Sa.

Hello everyone and thank you for joining today's webinar. My name is Rhys and I'm going to be your moderator today. We're going to kick off the session in about 20 seconds or so. We've just been waiting, so everyone has had a chance to join. Let us know where you're joining from using the chat and the comments. And yeah, let us know something that you'd like to get out of today's webinar. The session today is being recorded and the recording will be emailed to everyone that's registered for the event. I've put a link to that in the chat and the comments on all platforms, but if you haven't found it, you can scan the QR code on the top left of the screen right now. We are going to have a Q A towards the end of the session. So, yeah, if you have any questions at any point, please send them in the chat, in the comments and I will save them for the Q A.

Brilliant.

I think that's everything from me. So now I'll hand over to your host for today's session, Richie. Richie, please take it away.

Hi everyone, this is Richie. Now, today we are talking about data competency, and this is a phrase that was new to me until recently, and what it essentially means is whether or not your organization can be trusted to handle data. So today we're going to be talking about data privacy and complying with data regulations and other related topics. And hopefully it should be obvious that being competent at handling data is a pretty important skill set for any organization. But as always, the devil is in the details. And so now we're going to get some tips on how to get there. Our guest is Basil Hatto. He's the Senior Vice President of Product and Growth at NP Digital. And Basil's team uses analytics to help customers identify monetization opportunities. And he's got over two decades of leadership experience across media, startups, agencies and and tech organizations. And he was previously VP of Data Science, Audience and Analytics at Postmedia. So with that, please take it away.

Basil, thank you and hello everyone. I'm going to be talking to you today about this idea of organizational competency and data maturity. The thing that we'll focus on most is how do we create actionable tips for championing this context and this topic across your organization. So we'll touch on a couple of key elements, such as what are the factors that have led to where we are today in terms of making data privacy and data competency such a focal point for so many different organizations and also governments. We'll talk about data competency and this is the element, the framework that we've studied, we've modeled at NPD that help us formulate these discussions as well and then talk about the key learnings as we've executed as we've implemented and engaged brands in this discussion. What are the most obvious learnings and tips that you could take into your organization and begin to action today? And in my space I'm fortunate and unfortunate fortunate because I get to meet a lot of people. I spend a lot of time on a day to day basis speaking with different teams across organizations and business leaders. And the way this topic of data maturity and data competency evolved is because most discussions today evolve as such. We talk about certain elements, new government regulations, Oregon, Colorado Bill 25 in Quebec, I'm based here in Canada. So we have this notion of new bills that constantly arise, government regulations and we're always then interjecting new initiatives around how to handle personal information. What do we do in terms of establishing new sets for managing consumer information. And we loop again and talk about privacy protection acts, new privacy regimes that are happening and this notion of other circles and discussions that are evolving around addressability solutions from a marketing standpoint, ID resolutions and then talk about global expand beyond the locations that we're in. Understanding this now, this looped circles, these loop discussions is actually a very visual way of how most discussions have no wonder that the executives, the clients that we're speaking to in general feel exhausted, confused and sometimes actually anxious. It's because these intrinsic circles and discussions are almost never ending and conversations never end with clarity around who do we need to engage, what are our next steps or even what have we done enough as an organization. And that arises from the fact that regulations are constantly evolving and constantly changing. Just this past month, Oregon introduced SB619. We have the Colorado Privacy act enforcement now. These are things that we know have gone into effect in the US but now the European Commission is proposing new rules around increasing GDPR and the EU and the US are working on a new data privacy framework. In essence. I remember a colleague once told me that if this was an animal, it's chameleon, because it's hard to always understand and spot the changes and if you're not careful you can actually oversee it. And when they mentioned this to me, I was at a client meeting and I was walking them through this notion of a chameleon and privacy is a constantly evolving reptile. They referenced another reptile. And that is much scarier, much more intimidating that we would run away from and when we shouldn't, in essence, and we actually can't even afford to run away from. It's, it's that serious. And they recognize that there's a lot of consequences. Significant breaches have only increased. IBM released a study recently that the the cost of data breaches have increased over the last year. The average cost of business about 4.5 million. And to us recognizing this, we realize that there has to be a way that we can engage clients but also engage different teams, different competencies within an organization around this idea of how do we build better understanding of this? And that's the notion of what birthed this, this idea of data competency. It in essence, it's understanding, maturity, building fitness and readiness within our organization. And in essence it's a bridge between specialists and senior leaders and also a bridge between marketing, it, legal and finance and different teams and different talent to be able to prepare the organization to tackle these legislative changes as they happen. So we took these ideas of data competency and we decided to build this idea of a framework. And for us to build a competency framework, we had to go back and really understand the forces that really influenced and drove us to the situation we're in today. And we focused on three key areas and this is key because they influence the framework that I will be talking about later today. So there's legislative changes, it's this complex state, both state in national and global changes. There's the tech ecosystem between publishers, between Martech players, and obviously the big tech companies such as Google and Facebook. And then there's the notion of consumers who are more and more have rising expectations and recognize there is an imbalance in the value exchange meaning in how they share data and what they get in return. So I'll dive into these to give you context as to how they influence the framework that we have. So obviously in the US there has been, I think we've locked this down, about nine legislative changes introduced just over the last six months in Virginia, Connecticut, Colorado, Utah and California. But also we recognize that there's a lot of new initiatives that are coming. There's the California Privacy act, envisioning a consumer protection act that is launching. There's also the EU and the US Privacy framework that is coming up and new government regulations around enforcing gdpr. There's an essence, a constantly evolving ecosystem around legislations that is very important for us to understand and that will influence the framework. Second is the technology landscape and the realization when we looked into the technology landscape, that and a colleague really said this really well. And for those who are in the marketing space not realizing that when we're talking about data privacy, data compliance, actually a lot of brands and a lot of marketing teams are picking technology versus inventory and are picking privacy versus consumer interest. So this came to a realization that there's a lot of competing needs and a lot of conflicting interests that are driving the technology landscape. UDID solutions, for example, are designed for advertisers. Tech providers are creating walled gardens, and publishers, on the other hand, are just looking to protect their data. And this has led to a lot of different innovations, whether it's enhanced tracking protection, Google Topic, and enhanced initiatives, Apple's Privacy, Email Protection act, but none of them have that granularity, addressability and persistence and longevity that meets all these different competing interests. And as a result, we have an ecosystem where there's complex and crowded, fragmented technology landscape. We have systematic inequity in the advertising supply chain, we have inadequacy in existing measurement models, and we have an erosion of customer trust. Which brings us to this idea of consumers. And I want to be careful. Consumers are very smart. When we talk about understanding consumers, we're not talking about this idea of somebody is just watching me and I'm referencing the Rockwell song from 1984, which I was listening to before of this, to prep me for this, this discussion. It's much more complex. Consumers don't just look at data privacy as one holistic element. We've actually gone to market and we polled consumers in Canada and the U.S. and came to the realization there's five key distinctive elements to how consumers look at how companies, corporations and governments manage their data, and that's sharing, utility, collection, control, and storage. So are you comfortable, Are they comfortable in sharing personal data? In essence, sharing. Are they satisfied with the value that they're getting from when they, when they do provide that information to brands? That's utility collection, which is different than sharing. Sharing is information that consumers proactively give to businesses and enterprises. Collection is the data we collect in addition to the data that you share as consumers around your device ID, your IP address, your geolocation. On average, we collect about 90% more data than you share with, than consumers share with us. So are they aware of the collection that are happening? Whereas do you, as consumers feel you have the control? This is very GDPR centric. Do they have the control? And then obviously, do they feel like once they've given the data, once we've collected the data, do they feel like we can store that data and protect them from cybersecurity? So in essence, consumers are not just looking at data privacy as one specific or holistic ecosystem. They're actually looking at a much more fragmented element. And we know this because when we measure the sentiment across these different paths across the customer journey, we realized the sentiment starts really positive with most consumers and most industries realize the sentiment is trust, joy and anticipation that that quickly diminishes as we move down this path of data journey from sharing all the way to storage and collection and control is part of is one of the areas that consumers absolutely exhibit the surprise, fear, anger, sentiment most. And this is not just reflective of one industry. We realized this type of trajectory across multiple industries in finance and travel and in media, which to us scored the least across the entire customer journey. So, so these factors were really important because when we were trying to build a competency framework, this, this idea of understanding how legislations are evolving, how technology landscape is changing and how consumer expectation are rising and the perception of value exchange is broken, how do we help companies build the right competency and move forward towards being better prepared and engaged to be able to engage in becoming more government compliant, which is really key. Before jumping into the pillars, there's four key pillars that we've summed that encompass what we think organizations need to think about and how we are working with different stakeholders to build competency and expertise. And one is governance. It's the notion of is there a unified understanding of the data practices around the collection, storage and sharing happening across the organization. Second is the notion of people, culture and talent. And in essence, does the enterprise have the right competency required to even make the right decisions? Once we discover there's certain technologies that are no longer compliant, do we have the right development and training ecosystem? Third is about media and activation, which is really critical because most of the data that is utilized today is utilized for marketing functions and for growth functions. So how evolved is that media measurement frameworks, how do we adapt to new ones? How much information do we need to collect to be able to sustain, sustain and continue growing our business? And lastly, leadership, which is have we identified the areas of risk? And in essence is leadership ready to make the necessary decisions to be able to mitigate those risks that really influenced that framework of how we look at and how we built data competency across an organization? So I'll go one by one. So governance, it's in essence about future proofing your enterprise data policies. It's about establishing the value of data. It's about developing proper controls around data collection, data storage, and data sharing. And it's about ensuring it flows securely from one platform to another. It's also about having the proper documentation on what data is collected and why it's collected and how it's used across the different ecosystems, such as, like your Martech stack, ad tech stack, but also across different teams. Governance is really important because in the past we were able to capture all the data we wanted, and we were able to process and transfer the data across multiple ecosystems and platforms as we thought fit. But today we have to be kind of more purposeful, more intentional in the way we collect data and what data we collect. Someone really said this really well, and I don't know the name, but I am quoting someone in the essence, in the past, businesses were only at risk when the data was activated. That's when the risk happened. But in today's legislative world and in today's reality, collecting data poses a risk, meaning having data is by itself a potential risk for the business because of CyberSecurity. So there's three components to data governance that we build questions around that help businesses assess. And that's questions around data collection, data storage, and data sharing. Data collection is the first aspect of it, and it's the data being collected. And is it aligned with the organizational needs? And is what's being collected a requirement or is it a luxury? And whether it's a service for a particular department or does it have the utility that we think it does? There's no legislation stating that added data sets shouldn't be collected. However, collecting more data just simply increases the risk threshold for a business. And there's four key questions that encompass the framework that really help bridge that gap across teams. And it's how do we have a clear understanding across the organization, whether it's marketing it and legal, on how we use consumer data to drive business goals? Another one is asking the organization, do all the consumer data generated by the various business units, are they mapped and they're inventoried? Obviously, there's a lot more questions, such as, is there clear understanding across our organization of the data collection we exhibit and do most of the consumer data we collect, is it used for business goals and to improve the customer relationship, or is it just sitting idle? So data collection is a really key fundamental questions, and these are some of the questions that you can ask your teams internally to begin to entertain and build up that confidence. Data storage is about how we store the data. So do we have A solid understanding of the systems, the technologies and the processes that we can that we process data such as like geographic mechanism of the data and do we have a clear understanding of what consumer data is stored internally on our own ecosystem and what data is stored externally with our partners and vendors? Obviously you can ask questions such as do we leverage encryption to store data or are we storing PII data in our Martech and Attic environment? And do we have any specific privacy procedures to ensure only authorized teams and individuals can access data certain data across the organization. And lastly, it's about data sharing. So it's the flow between internal and external platforms. It essentially must always be well documented and well understood. Each platform today and each vendor must have this clear alignment on what data is being processed and how it's being utilized. And the most common requirement for this and why this is critical is for GDPR compliance or opt out requests. So understanding how you share data is fundamental. The questions that we've encompassed in the framework that can help support you in understanding the data sharing practices and is asking the question, do all the consumer data flows between internal external platforms mapped, understood and documented? And do each vendor that we engage with, is their role in the data processing ecosystem clearly identified, mapped and have we communicated that to them? You can also ask questions that I haven't listed here around accountability. So when a user opts out, who ultimately hones the accountability to making sure that data is opted out and that information shared back with the user on a per request basis and where all the potential problematic data actions and associated problems have they been identified and have we documented the subsequent actions to mitigate that risk? Data sharing is fundamental in many ways. We think this is one of the areas based on our analysis that I'll share later on is where a lot of the exposure happens internally. So governance is really key. It's the first pillar that we think is fundamental to engaging in data competency across the organization. And those are some of the questions that really drive that conversation internally. People is obviously absolutely key. The questions within Talent culture are really meant to assess competency. Competency is applicable knowledge, experience and attitude. And it's a way of ensuring that different teams are they empowered? Do we have the right people to make the right decisions and are we investing in training? So these are the three elements of data competency and people and culture. Start with competency first. I love this notion of what Simon Wordley once highlighted and pointed out that not everybody across the organization needs to have the same expertise. It's the realization that adapting towards the future requires a multifaceted organization with different levels of expertise and pockets. So we studied organizations that have organized themselves based on these tribes with certain skill sets. A tribe that is focused on innovation, a tribe that is focused on scaling a platform across an organization. This has been one of the most most observed good practices. But in essence what I'm referring to is think aptitude, not attitude. So have your internal expertise do we have do you have the internal expertise to make decisions on technologies and effectively assess privacy compliance with partners and vendors? Ask yourselves questions around have we established a data governance body internally that encompasses people from different teams and different departments so they can document and map the data flows across their organization? Ask the questions of do we have the right internal teams and expertise to navigate the legislative changes? And is the team ultimately empowered to make decisions on which data to collect and which ones not so competency is really key. It helps surface these level of expertise as well. Development and training well, this is about building up, creating a common language around data and fostering an environment that enables individuals and teams to engage in data privacy dialogue. It's also about ensuring that the right people can make the right decisions. And it's really fundamental. We'll talk about the Duncan Kruger effect bias when people who underestimate their overestimate their skills make decisions around this notion of data privacy. But the questions that can help you assess development is do you have a plan or do you plan to hire a person to lead data practice and guide the organization forward? Are you investing in training and continuous development in understanding the risks posed with managing data? And that those are really fundamental? We're not talking just about how you open emails and things that are pertaining to cybersecurity, but in essence, as a marketing team, are you engaged, for example, to dictate what data is really critical for you to achieve your marketing goals? And lastly, is around accountability. Do we have a clear understanding of the roles and accountability as it pertains to data collection? Is there a certain point of accountability across the organization for when things don't go well, or when or when we need to move certain elements forward, whom we can engage? Is our team empowered to address data privacy quickly when identified, or is there a very elongated process, complex process for us to mitigate that risk? So those are really fundamental to accountability. It's not just the notion of who is accountable, but once we identify the risk, how quickly are we able to address that? So those are the fundamental three key pillars of data and talent that drove the framework, its accountability, its development and its competency. And the third pillar of the framework around data competency is around marketing activation. It's probably the department that uses data most actively. Unfortunately. Also it's the team that could pose the most amount of risk to business in how they activate data. As I hinted at the beginning, a lot of the data breaches are driven by through data we collect for marketing purposes. So the questions within this idea of media and utility is how an organization's data competency affects its media and marketing. It evaluates the ability to capture data from various sources such as web properties and apps, and assess the level of data transformation applied. Do we do any profiling and are we using AI as well? These questions are also there to assess how data is used for media and marketing purposes such as partnerships, platforms, trade desk, and whether you have the right measurement frameworks that are either relying too much on PII data or using data driven attribution. Or are you leveraging media mix modeling as appropriate? So those are the elements of media activation and it starts with how you capture data. Is your marketing heavily reliant on consumer PII data? Do you transform the data sufficiently when before doing any marketing activations such as profiling? And do you have any clear understanding around how your media partners and vendors generate and transform the data that you share with them or how they actually collect the data that feeds into your ecosystem? The second notion is around data utility. So it's the level of data transformation, utilization and profiling. How much data manipulation is applied to make the data useful? It's about questions around is our data analytics input evaluated for bias? Are we currently passing consumer data to external partners and do we sell our data right now? And this is becoming more of a discussion due to the rise of clean rooms for those who are engaged with partners and publishers around that discussion? So this is really fundamental because that's where a lot of the risk is exposed as well is around the data utility. And then from an internal measurement standpoint, it's the discussions of how you report on marketing with the deprecation of cookies, with how. What type of measurement framework are you leveraging? Do you leverage data driven attribution or is the measurement framework heavy reliant on cookies? If so, are you testing new measurement frameworks? Are you testing media mix modeling to be able to track the impact of your marketing spend? And also are you reporting only on C metrics? Have you explored bringing customer sentiment, brand sentiment as part of the measurements into your marketing rooms and executive? So your media measurement is becoming more and more fundamental as well. So the three key pillars that from within this framework that influence media specifically, it's your ability to generate audiences, it's how you share that data and use it, and your measurement. And lastly, the last part of the data competency framework is around leadership. And these questions help you assess your organizational readiness to make decisions that minimize risk. These questions include testing new platforms, being transparent about data processes, aligning customer views with strategy, anonymizing data, minimizing your data collection, or even switching to safer, more data privacy compliant platforms. The questions also assess whether your management team and leadership team is involved in driving success and implementing effective data governance. So in the decision an organization is making, it's also is it able to make an action those decisions fairly quickly? And speed is something that we'll touch on as well. So the first element of the governance pillar is around risk appetite and the risk associated with processing data. Is it well researched? Is it well documented? Is it well communicated? Have we as an organization made the necessary decisions to mitigate the highest data risk areas of our business? It's questions around are we equipped and are we prepared to comply with all government legislations regardless of the regions that we operate in or holistically across all the regions that we operate in? The easiest one to think about is your data privacy and your website privacy policy up to date and you have a clear roadmap as a business on the technology changes that need to be made to become more compliant or to prepare for the future. The second one is around your overall company mission and vision and how importantly integrated is this notion of data privacy and data compliance is? So is there a clear understanding of the overall mission which basically in essence informs and guides our data processes? As an organization, do we think customers trust us with our data? It's something that we are realizing a lot of businesses are unable to answer themselves and questions around do we have a clear defined innovation roadmap that we've outlined so that we can truly materialize or extract the value from the data that we collect? And is the executive leadership team highly involved in this process? Are they receiving constant updates on the progress towards data compliance and changes in the regulation? So it's really in essence the link between that and senior leadership and the different teams across the organization. And how integrated is your data policy as part of your mission is? And lastly is partnerships? Do you have the right partners? Have you been engaged in a clear roadmap with them on what changes they need to be implementing or what new innovations they're introducing that will better Position your business for the future. So in essence, that's something that it really is a reality that most times most of the technologies that brands are using are not their own. They're not built in house, they're actually probably licensed. So how engaged are those teams with their product, teams from those vendors in understanding their roadmap, understanding the risks within their platforms and such? So I just walked you guys through these, like four fundamental elements that drove that framework. That data competency, which is governance, talent, it's about media and utility. And lastly, it's about leadership. And all those questions, in essence, they, when formulated, when answered, they can help a business establish a competency score that really in essence tracks their readiness. And by answering those essence of questions, you can develop a score that businesses are then able to create a roadmap and create action plans that will help make sure that data competency is always at the forefront. It always ensures that different teams across the organization are integrated and aligned as part of these discussions and helps you build the score that you can also assess and review on a quarterly basis, semi annual base or even an annual base. And what we're proposing in our framework is having multiple departments and multiple stakeholders fill it out. So when you're building these score measurements, it's not just a one person's input, it's actually multiple people's input, which is really critical. And then set goals every quarter, every year, for how much you want to improve those competencies. And by just improving and aiming to improve those competencies around talent, governance, around your media and your leadership, the company's ability to tackle data privacy and legislative changes simply improves. Because the essence is it starts with it by looking internally. We've been doing this now for a year plus at mpd. So what I've done is I've actually looked at what are some of the insights from these Sprint workshops and what were the most common initiatives that we found to repeat themselves across different organizations. So one is map your data flows. So develop a data roadmap for how you collect data, which is really critical. What data you collect, what practices you use that data for, not just for marketing, but even employees employee data. How are you managing that data? It's really fundamental. So mapping data flows is probably the one that we've seen always pop up, which means most companies are not actually tracking and documenting how the data is. Second, is updating their data privacy. Most data privacy, as we notice, they are not up to date. And specifically I'll be very specific in the sense that now there's geo differences in privacy between Colorado, between California, between Virginia. Your privacy policy must reflect those different changes. Collect only what's necessary, ensure that data is authorized. Make sure that the privacy policy clearly state what you're using that data for, and make sure that it's understood as to which region that policy applies to. Another recommendation that we've always seen from the different clients filling out these data covenants is refine your customer procedures. So if there is a breach, how do you respond to it? What are the process? If there is a request for data and delete, how do you process that information? Do you have that? Most of the time we're seeing that it's not refined and a quick update and tweak of that can really go a long way. Another recommendation is just conduct an impact analysis. If there are risks, go through all the different data sets that you're currently collecting and start posing the question, what is the purpose? How much of that data are we collecting? Can we minimize that data or do we need to keep it? Basic questions around PI that can really go far for a lot of businesses. Fifth is implementing and updating your vendor data recipient management. So obviously it's about contacting your vendors, understanding what data they're extracting from you and generating from your partnership how they're storing that data and then ask very basic questions. How are they tackling data privacy, cybersecurity, how they're storing data, what's their practices? All these documentations should be available. I mean, the simplest way is do they have a SOC compliance documentation? And if they don't, that definitely raises a flag though most vendors should have that. These are part of the checklist that you can develop as well. And one of the things that we've seen as a very quick action that businesses and brand teams can implement, obviously reporting and record keeping and training. What is the training that you have today across your organization? Do we have access to latest news, latest articles, and are we doing testing modulations internally for people to develop their competency and understanding of the legislations that are happening in their space or the risks that managing data poses. So basic governance. A lot of this can be driven by hr, but that's something that we've seen a lot of businesses that have not even gone that far. So that's definitely an action item that you can take. And lastly is about implementing data security and incident response plan. It doesn't have to be complex, it's just if this happens, who should we contact? It's about accountability, it's about responsibility, it's about understanding who to reach out across the organization so that we can move a bit faster. So we've done this across, had this pleasure to speak to over 500 execs and marketing leaders and different chief technology officers over the last year. And in doing these analysis, these were just very prudent reoccurring recommendations that come out of the plan that you and your teams can take and try to assess do we have this or not? But also there's a couple of other things to note when when we complete when you complete this framework, you always notice certain characteristics and traits that materialize because the idea is to have different stakeholders across the organization completed. So I wanted to share with you guys some really practical findings and guides about what we noticed from how people actually manage data internally and what are some of the interesting findings from a governance we noticed there's not enough transparency. So our advice is be transparent. Have a bias towards openness within your organization. If you want to effectively learn about privacy and data competency, then you need to share your operating way with others and allow them to add their wisdom and their and to allow also to challenge the process. So building privacy compliance in silo is a surefire way of having problems in the future. So definitely, definitely try to be as transparent as you can. Another interesting characteristic that we assessed in the governance is think small. Obviously sweat the details. That's what I'm what we're saying here. Use small teams and break large data landscapes into small contracts. Don't be chased away by fear of complexity. Really go ahead and sweat the details. It's a really fundamental characteristic of a really strong data organization with strong data competency from a talent Distribute the power. So have the bias to distribute power away from even yourself. Put the power in the hands of those who are closest to the data and who make choices based on that data. So involve multiple departments. It's not just a marketing function. It's not just an IT function. It's definitely not just a legal function. It's an organizational necessity. Beware of the Dunning Kruger effect. It's this notion that really specialists underestimate their contribution and people who are not experts in data overestimate their contribution. Allow your teams the environment to make decisions. Distribute that power from a media standpoint when create an organizational system which copes with constant change and especially from media landscape, ideally change should flow through your organization without the need for constant restructuring. Especially from your marketing standpoint. Changes should not always involve new technologies that need to be integrated and try to minimize those transformational data initiatives as much as possible. Because the more we've noticed through our analysis that too much technology change opens up the risk significantly. And obviously leadership, don't attempt to create a perfect map, really have a bias towards action, because the landscape will change and you will discover more by action, you will discover more by playing the game. So that's really fundamental. So key changes, obviously I wanted to share with you today, but when you develop that framework, those five key analysis is some of the things that we've always observed and we're working with teams to just. It's not just about technology, but also about changing mindsets across the teams. So just quick takeaways, guys. Data privacy is a continuous process. Understanding where you are is fundamental. To know where you want to go and competency is that first step. And use that framework, use those questions and we'll share with you a QR code that you can download 45 of those questions that we've used as part of our framework so that you can start to circle them internally and have different stakeholders complete them so you can start to develop your own score internally and build yourself forward. And that was it. Thank you, everybody.

All right, fantastic. Thank you so much, Basil. Now, in general, I think with data privacy, a lot of organizations, they're like, well, you know, that sounds sort of hard and it maybe gets a little swept under the carpet or they're thinking, okay, there's a risk of some kind of a disaster and it becomes a terrifying topic. So I really love that idea of having a framework that just takes you through it step by step and breaks it down to. Into manageable problems. So it's something you can get started with easily and it's not going to terrify you. Now, for everyone in the audience, if you've got questions for Basil, please do add them to the chat. In the meantime, I have a few questions, so I'd like to talk about data governance first. One of the things you mentioned a few times was the idea that really you should only collect data, sort of the minimum amount of data that you need. But I think in a lot of cases, particularly like, if you come from a machine learning background, you're like, I want all the data that's going to make my models better. And maybe from a business background, you're. Well, I'm not sure what business questions I'm going to be asking in the future, so maybe we'll just collect some data just to be, just to be on the safe side and you get the sort of hoarding Mentality. Do you have any advice for how to deal with that and how to make sure that you are only collecting just the minimum amount of data?

There's two notions in there. There's obviously this idea of AI, Richie, that you touched about and when you are leveraging AI. So there's a question here. There's. There's two actually facets to what you mentioned, data collection. And you can have some control over the way you collect data, but when you leverage AI, a lot of chief data officers, one of our biggest concerns is data leakage that happens as a subsequent effect of using AI machines and how much data becomes available in public domains or is stored somewhere else. So that's, that's a. Definitely a risk. We're definitely noticing that minimize, minimizing that risk is a top priority for a lot of us. So you, you can have some control on how much data is shared with you. You have less control on how much data you collect. You have more control in how you store the data. I'm going down the customer data path because I think it's the risk parameters really change. You have more control over what data you bring into your data lake, your data factory ecosystem, and then the risk increases again when you talk about data sharing. So when you're leveraging AI models, definitely there's risk of data leakage that happens there. It fluctuates across. So it's not one thing or another. It really is a fluctuating, call it wave that you constantly have to tweak yourself to. But when it comes to AI, definitely big risk. Our recommendation is always pay close attention to what you're leveraging AI for because that increases the data leakage and creates more risks for your business.

Okay, thank you. And related to this, another sort of theme of what you were talking about was around really you want what data you have to be well documented and how the data flows through the organization to be well documented. So can you just expand a bit on what sort of documentation you need there?

Yeah, it's a very simple question. I've been working with senior leaders around this and a lot. Been working in data for many years right now. And most teams are drowning in the data, Richie, rather than swimming in it. And that's because we try to solve problems. We observe that a lot of teams try to solve problems by looking at the holistic data sets. The recommendation that I have is turn it upside down, look at the business objectives. So to determine what data you need, look at the outcomes and the decisions that the organization is trying to make that can help that backward forward. Thinking of understanding the objective can really influence and guide teams as to what data is really important. And that can drive your reporting mechanisms, your measurement mechanisms, but also can even influence the type of vendors and partners that you work with. So understanding the business objectives first and the decisions that are required should be the simplest way to tackle this and probably have the best governance as well.

Okay, and maybe do you have any concrete examples of when like you would choose to not have some data versus like actually have that data? Like, how do you go about deciding what you should keep and what you should document?

Yeah, absolutely. I'll use a very simple example. I hope it's relevant to everyone here. But I worked in the publishing space for many years and when you're trying to, for example, one of the key objectives is understanding lifetime value and understanding subscription behaviors. And the notion was we needed to bring all the data from subscriptions, from our cdp, from our analytics stack into an ecosystem to be able to do the modeling. But that was not the purpose. And we always gravitate towards trying to build the ideal holistic ecosystem before being able to action and produce meaningful business work. If I may say that that is what I've experienced a lot of teams undergoing is the notion that let's bring it all together and then let's decide how we use that data. So because we realized that actually we just needed to calculate lifetime value, we looked at all the columns and tables that are available within each of our vendors and then we dictated which data sets we need to bring into our data factory. And by doing so, we minimize the risk of having unnecessary information with our ecosystem that was not going to be leveraged. And the notion of storing that data, even it was not used by itself, is a business risk. So we were only, we realized we don't need to bring all these data sets, we actually decided to only focus on two platforms. And then we brought, we only brought in certain data sets into our ecosystem that were only relevant for whatever reporting and measurement requirements we had. And we ignored significant portions. There was a lot of, a lot of modeling that was required ahead of time. But that, that work, that upfront work and understanding all the columns and tables and the subsequent data, really, it was really important because it was educational, but it, bringing only what's relevant was minimizing the business risk. So in essence, that's how we've tackled it. That was one of the most, that was one of the most recent exercises that we've done. Okay.

And really was going back to one of the business goals. And that helped you decide what you actually need. All right, I'd like to talk a little bit about the people side of things. So you mentioned that, for example, you might want to decide to hire a chief privacy officer. And this sort of thing feels achievable for large organizations, but maybe not so much if you're. If you're a small company or a small business. So what? Who are the people who need to be involved in privacy? Like, depending on the size of the organization.

Definitely the most senior people as an organization. So even if it's a small business, obviously it's not the most engaging conversation to have. It's not the easiest conversation to have. The purpose of us creating a framework with very simple language, Richie, was to actually build a bridge so that multiple teams want to lean in and be engaged in this conversation. I think the simplest way is any person across the organization that leverages data, if it's a small business, should be part of that conversation.

Okay. And related to that idea because it does involve so many different teams. Privacy is going to affect so many different parts of the business. How do you bring all these people together so your data teams, your IT teams, your legal teams, your management, how do you get them in the same room?

What's in much process in much larger organizations? Obviously you have multiple people in different teams and you have different stakeholders. This is an opportunity to really assign people to represent departments. So one of the good practices that we've seen and currently is being implemented across the different clients we've engaged is the notion of, here's a representation from our media team, here's a representation from our measurement team and data team, here's a representation from the engineering team, legal, and that holistic overview. Those champions, I'm going to call them data competency champions across the organization is a really healthy structure. And the notion from there is do the framework, do the analysis, start documenting the data and making sure the conversations happen at a consistent cadence so that this does not get sidetracked. Because priorities will always do that for. For will over overtake and become more important than data privacy, because it's not something you can tangibly see and you're not delivering a subsequent subsequent outcome. This idea of data privacy is just an exercise of mitigating risk as well. Right. So you're hoping that you never have to go down this path. You're hoping that you don't hear about it, and you're hoping that all these discussions and all these documentations are actually working. That's why you're not engaged in it. That's why it's never rising to the surface. So that's the Richie that's the common practice is having these representative and making sure there's an ongoing engagement, a consistent communication cadence, monthly, quarterly. It depends on the complexity and depends on the size of the organization. Meaning you don't need to have a chief data officer always. You can have multiple people play that role and just one person leading the initiative.

Okay, so as long as there's someone accountable in management, then, and you've got the right people in the room, then it's okay. All right, so you said something interesting there, that data privacy is really like about mitigating risk. And that's kind of interesting because if you're doing it well, I guess no one sort of notices. And it's just when something goes wrong that suddenly there's a disaster and everyone needs to deal with it. So in general, how can you know that you're doing data privacy well? Because I guess these sort of disasters are going to be fairly rare, even if you're doing data privacy badly. So what's your sort of metric for success?

Response time is an interesting one. So one way we can tell right away a team that is well structured and prepared versus not so a simple question is, can I see the documentation for how data is stored? Just the practice of being able to answer this question consistently and cohesively with a proper documentation demonstrates that there's a level of understanding. That level of understanding is a step forward when it comes to data competency. And that's a good practice. So that's one thing that. And if it's not, if understanding accountability, if understanding that there is no point of contact, there's no single point of reference for this around this conversation, the risk means it just increases exponentially from there.

I felt there's a lot of people in the audience just sort of sweating right now. Like, in general, if you ask someone like, oh, where's this data? Is it documented somewhere? I think in most organizations the answer is probably maybe or not very well or maybe even not at all. So, yeah, just getting your data doc, your data document just seemed like an incredibly important first step that a lot of organizations just don't take. Okay, so just related to this, I'd like to talk a bit about skills. So I know we have a lot of data practitioners in the audience, so can you talk a bit about, like, what do data analysts and data scientists need to know about data privacy? Like, what skills should they Have.

I'm gonna. I think the key important element for data analysts is understanding the data sets that they have on hand and understanding that certain data sets, how to use that data set. I want to go back to referencing because you talked about data analyst and I think more and more this notion of AI to facilitate data modeling and data analysis is because becoming. It's becoming a very common practice as well. And we're relying more on external platforms to do a lot of the data analy analysis and data analytics for us. So when it comes to those specific teams, I think the biggest notion for them is recognizing what data to use and what is not to use and at one point which of those platforms that they are leveraging, how that data is leveraged, if it's stored, if it's creating a data leakage. That's one thing that really stood out for us in our findings is the amount of cool platforms and innovations that are arising and the testing and the innovation that is happening with these platforms is leading to a higher risk for some really important businesses. I'll take for example Samsung Richie, which whose product team uploaded the specs for one of their product that now exposes all the breaches that. How you can actually breach one of their. The platform, I don't remember, but it basically opened the floodlight floodgates for understanding how to use that. How do you compromise their platform? So that's one thing to note is those platforms are not always safe for data analysts and data scientists. They have to be very careful and engage with your teams to make sure you do the right due diligence before.

Absolutely. So even just like storing something in a place that's maybe not secure and someone gets access to it, that can really compromise your business in some way. Okay, and is there a difference for people who maybe don't have data in their job title? So they're not sort of technical data people. I'm thinking people like leadership or maybe product managers, things like that, what do they need to know about data privacy? Is it a different skill set there?

It's a very loaded question, obviously. Rich, I would say I want to go back to that concept and notion of competency. It doesn't have to be technical. And our intention was to create conversation and language that anybody across the organization can engage with. Because we are seeing, we've been talking to hundreds of businesses that you can't have one single language because not everybody would understand the notion of how data is transferred from one platform to another, whether an S bucket file, some notions of how Data operates is not common language for every everyone. So the, the idea of creating a series of frameworks and questions that anybody across the organization should be able to answer is to actually help bridge that gap from different teams. Whether you're actually very data savvy or if you're not at all data savvy, or whether you actually are using data in your day to day work or whether you're not. And that's, that's the, that's the notion of data competency is download these questions, ask, share them across the organization and do a workshop and see how much of those are you able to effectively answer and then assess which teams have what was the score across the different teams or different departments and where do we think we have a lower level of understanding or a certain level of understanding around data competency, which touches on maturity, touches on privacy and where we need to work as a team to mitigate. So it wasn't a specific thing and I hope by answering your question, because I just think that language is really key to getting organizations to think forward.

Okay, so it sounds like once you're sort of a manager or an executive, what you really need to understand is like, where are the problems likely to occur across your business, like which teams or which areas or which departments? So you just need to be able to, I guess, identify the risk. Have I understood that correctly?

Correct. I think by answering those questions, once you have it developed and have a good understanding around your governance, your talent, your media utility and your leadership, you'll be able to tackle legislations and data privacy a bit with a bit more confidence. Because the foundation of all those legislations touch on every single pillar of that framework. We just basically change the language to make it more appetizing for, for a regular person as well as a highly skilled data expert.

All right, fantastic. I've got one more question for you. Oh, and we've just got a question from the audience. So before we get to that, I just want to say that September is Data and AI Literacy Month. So we've got a lot of events coming up around how do you get started with working with data? How do you get started working with AI? What do you need to know if you don't have data or AI, your job title. So we've got a few webinars next week. So Tuesday is empowering government with data and AI Literacy. So we've got someone from Ofcom, the communications regulator. On Wednesday we've got a session on using data camp classrooms. So if you are at university or in A school. Then you can have access to data camp classrooms. And on Thursday there is session on making decisions with data and AI. So it's gonna be really good for any, anyone interested in management or data driven decision making. All right, so with that, okay, let's go to an audience question. And we have question from Dorothy saying basically just this on the. The last thing you were talking about. So is that why, uh, companies tried to keep administration. Oh, hang on. Why are companies keeping secrets to an antitrust watch? I'm not quite sure I get the question, but I think it's. Wait, is. Okay, I'm not sure. Basil, have you got the question? I think it's something about like, why. Why Dorothy, do you want to explain again in the chat? Otherwise it's like, why are companies keeping, uh, secrets from their competition? I think. Do you want, do you want to talk a bit more about the motivations of why you might want to keep data private? I think that'll work.

Well. Keeping your data private, you have a social, legal and moral obligation to make sure that the data you collect on consumers is protected. So that's like a legal, moral, and also it's a requirement for all businesses in terms of the competition. I'll try to take a different angle. Being data compliance is actually a competitive advantage. So if you do get compromised, it is something that can be used by competitors and that could potentially jeopardize your market share and your positioning within. Within your sector. So I don't know if I'm answering the question again, I apologize. But you mentioned competition, you mentioned data privacy. I'm just gonna sum it up by stating that data competency is a competitive advantage. And I do see now, do companies keep administrative staff longer to protect company secrets and prevent antitrust violations? Oh, I. Not to my notion. And I, I think you're referring to how talent. I assumed, Dorothy, how talent moves from one organization to another. Again, this is not legal advice. I'll talk about one incident in Canada over the last. I don't know how many years in which one person who used to work for Microsoft was prevented from joining Bell. Dell. Sorry, I probably. Was it. Was it Dell? I forgot the company. This has been years ago, but there was only ever one incident in which an employer was able to successfully prevent an employee from joining a competitor because of their position. But the subsequent outcome of it was they had to pay this person's salary for three years afterwards as well. So it's very rare that companies can stop people from leaving. And ideally, the best way to do is treat your staff well to make sure that they don't leave. That, that's an, that's, that's the simplest way. Make sure you respect your team and treat them and give them the opportunities to grow. So that's definitely not a data advice, not a data angle. But from a legal standpoint, I don't have any record of companies keeping people on longer to avoid to protecting their data and secrets. And in Canada, we've only had one incident ever that that was ever successfully achieved.

Okay.

Although it does seem like a happy note to end on is if you treat your employees well, they will stay longer and maybe that's going to help you out with data privacy. All right, thank you once again, Basil. That was really informative, really amazing. And yeah, the framework for data privacy looks very useful. All right, thank you to Reese for moderating. Thank you to people who ask questions. Thank you to everyone who showed up and listened today. I hope to see you again in future webinars. Please do go to datacamp.comwebinars and I will see you in future sessions. We have so much exciting data and AI literacy content coming up in September. See you all soon.

Thank you.