I4ADA Jonathan Reichental

Welcome to a dialogue on accountability in the digital age. A dialogue with representatives of a global multi stakeholder community.

And I'm your host, Fritz Bussemacher. And I'm delighted and privileged to have a conversation with Jonathan Reichental. Jonathan, welcome to the program.

Thanks, Fritz.

Allow me to introduce you to the audience. You are Dr. Jonathan Reichental, multi award winning technology and business leader, founder of Human Future, a global business and technology advisory, investment and education firm. You are an associate professor with numerous universities over the years, former CIO of the city of Palo Alto and O'Reilly Media, author of a number of books including the latest Data Governance for Dummies. And that's going to be the topic of today's discussion. Great. Hey Jonathan, let me begin with the obvious one. What is data governance?

What is data governance? You know, it's maybe like a term that a lot of folks haven't heard about, but you're going to hear about it. This is going to be rising in the list of priorities for organizations like to give a good definition. You kind of have to understand the context of the world in which we now are operating and the one in which we're heading into. And it's not going to be any surprise to anyone that data is increasing in volume, of course, in variety and in speed, velocity. It's at scale, right? We're creating now every few days zettabytes. Zettabytes of data. One with 21 zeros of data. We have to call this quantity of data using words we've never used really before they've existed, but we didn't know that they existed. So zettabytes, right? And every organization, almost every organization, is creating data, collecting data, storing it, using it. And here we are, third decade of the 21st century. Are we managing that data well? Are we taking care of it? For example, is it secure? Real basic question, right? And are you conforming to the regulations of your country? Right. In terms of how you maybe handle healthcare data or you know, just private data, things like your driver's license number or your home address. Are organizations handling that data appropriately and according to law, are you complying? Right. But I think an even better question is are you using this volume of data to create new value for your business? Are you using it to innovate? Right. And to do that you have to do things like, for example, you have to find your data. You have to be able to find it. You need to know what you have. You need to know and also ensure that the data is good quality. Okay? So all These areas, you know, high volumes of data, ensuring that you're managing it well, that you're making sure it's compliant, it's secure, and you're innovating and building your business around that, this incredible asset. That's what data governance is all about. That's what it is. It's, it's the actions you take as a business to ensure you're meeting those core requirements of your organization. And the businesses that do that well are more successful. Obviously they get a lot less fines because they're more compliant. Right. They're a lot more satisfied because their employees can find the data they need to do their work. Such a, such an important core concept. And so why, you know, why now? It seems to me when I explain that and share that with you, your listeners are going to think, well, that's so obvious.

It does sound obvious, but what was the trigger for you to write that book? So why did you write it now?

Yeah, yeah. A few years ago I was asked to create a short video series on data governance. You know, I've been a, I've been a CIO a couple of times in the past. So, you know, data is a big part of the, the Chief Information Officer's role. Right. And so I knew the topic quite well and I was asked to write a video series. The video series is very popular. It continues to be popular today. I just did a new version of it and then my publisher Wiley, who I have a multi book contract with, they approached me a year ago and said, this is a gap in our series of educational books. Could you write a book on data governance? My reaction was I definitely can, but I'm not sure I can write a 300 page book. I ended up writing a 300 page book. And so the genesis was the ask. But look, why did they ask why now, as you point out in your question, first of all, the volume of data, the importance of data, the cybersecurity issues, the compliance issues are all escalating. They're all growing at a phenomenal rate. Right. The risks of data and organizations are trying to do this. Actually, most reasonable organizations manage their data, but they don't necessarily govern their data. Right. Govern tells you how to manage. That's an interesting connection. And so organizations have databases, they have data analysts, they have data analytics tools, they do archiving, they have cybersecurity professionals. Yes, organizations manage the data. But the question I'm answering and data governance answers is, are they doing it well and is it adding to the value of the business? The timing now is important because of this escalation of data. We're in the zettabyte era, creating 100 zettabytes a year now. We'll do that, and we'll double that every two or three years now. So it's getting bigger and bigger. So we're in this, what is often called a Cambrian explosion of data, period. Right. And here's what's happening. Like about 90% of organizations who try to put in place a data governance set of initiatives and programs fail. The failure rate is extremely high, and that's the real data point. Right. So how can a book. How can, how can I as an educator help? That's what I want to do. Yeah, I'm passionate, you know, I'm passionate about education. So the timing is write a book in simple terms to help people answer this question and to be more successful. The last point I would make about why now is leaders, business leaders, all sorts of leaders and all types of organizations are beginning to recognize the importance of this. It's not like I, you know, I came along and said, hey, this is important. They kind of get it. You know, if you're a CEO and you're accountable, right, you know, to your shareholders, to the public, you know, to your staff, to all the different entities, your stakeholder group, you could basically get into trouble if you don't manage data well. I mean, here in the US not only are there big fines, but, you know, ultimately you can go to prison if you, if you really don't comply with your obligations as a, as a leader.

Right.

And, and so there is this increase in, in awareness and desire to, to be successful. And I'll just give you another data point here. Over the next 12 to 18 months, there's going to be a 31% significant growth in investment in data governance by organizations. That's huge. The right time.

Is that a global number or.

That is a global number. Yeah. All my numbers are global. Yeah. Yeah.

Okay. Hey, you triggered me to a question which allows a little bit of a long introduction because in the past I used to work with CIOs as well. If you talk about 10, 15 years ago, you'd see a CIO. I mean, once something is in an, in an IT system, once something in a system, it's the it's problem. So the CIO was also seen as somebody, okay, that's my data. Now we see a shift. Look, no, it's the CIO just delivers the system, but it's the business data.

Yeah.

At the same time, I also now see the emergence of a chief data officer. So it's almost moving back to responsibility or accountability. Okay. It's back to in the, the IT domain, as it were, digital domain. What's your view on that? So is it enough to have a chief data officer or should we also in the governance of technology, of this, of the data. How do. Are we going to take the whole organization there and understand what that role is?

Yeah, no, that's such a great setup. Exactly right. By the way. Exactly right. And this is the transformation that's happening is this is not an IT topic. Now based on you and I, we have this, this great history in technology and our leadership in leadership, leading enterprises in terms of the tech, you know, there was the business, you know, focus on market, focus on sales. IT can take care of everything. Technology. Well that those lines that's blurred now. Right. Everybody's a technologist. Every organization is a technology organization. You know, the CIO is at the table with the CEO and the coo. Right. It's all melded. We have to all be one working towards managing the organization to technology driven in order to be successful. So traditionally, as you point out really well in your question, your setup there, data has been the domain of it. We call the IT role the data custodians. Right. And that role, by the way, is still important. It's vital, no question. Right. That's the data management piece. Right. So whether it's in the cloud, which data increasingly is, or it's in our data center, it needs to make sure it's secure. Only people who should have access to it, that it's archived in the right way puts in place the mechanisms for managing that data. Turns out, and a big part of my book, by the way, it's very fascinating you asked this question. Big part of my book is about responsibility. Who is responsible? And it turns out as I did my research over the last 12 months and, and I interviewed companies and I read the literature and I looked at the tools and everything. This is actually a cross functional responsibility. It does start with the CEO. Right. Does start with the head person who is accountable for the success of the organization, the compliance of the organization. And it trickles down through every part of the business. The chief financial officer, big responsibility for financial data. Right. The chief human resources officer, big responsibility for personnel data. Right. The auditor, the legal people. And then you've got the data science crew, the people who often now led in large organizations by a chief data officer is helping to manage all those parts of IT as well. But also use tools and talent to extract additional value from data. I mean, that's at the core of this is. You know, I was at the, I was at the city of Palo Alto for, for many years as their, you know, head of technology and innovation. And I, I recognized very early on that our government, and it turns out most governments, have a lot of data just because it's created as part of running the organization. And you know, and often the data was created because just in the act of, let's say, creating permits or just managing transactions, we created data and we did it and then we stored it and at some point we archived it. But then I asked the question, do we do anything else with it? Do we ever analyze it? Do we ever look for patterns? Do we look for trends? Do we present reports? And generally the answer was no. It's like we just kind of used it for one primary purpose and that was the end of it. Well, look, there's, there's, there's richness in that data. Right. That data tells the story of your business. That data tells the story of your organization. And if you're really good at it, it could tell you the story of the future of your business.

I like that you talk about Palo Alto because this is actually a nice segue to another question I had for you.

Sure.

And that is we're currently talking about data governance, but I'm doing a large project for the Dutch government where I'm also involved in talking about information governance.

Yeah.

Is this semantics or is this a significant difference?

That's great. You know, I'm laughing because I had to deal with this question. So not only is there some confusion on data governance, information governance, and then data management is the third one. Those three are often interchangeably used. So data governance, data management, the manager piece is different. So I just want to be clear about management is like, is actually doing the work and then the governance is establishing why and what and how and who and that type of thing. So that's important. Data governance, information. So, so the difference between data and information, and I talk a lot about this because there's, you got data information, right? You got, you got things like knowledge, insights, wisdom, right. So there are different ways in which we look at content data. If you just look at data on a screen or a piece of paper, it actually doesn't have to be meaningful. And it can often be just. In the case of structured data can be rows and columns of just numbers and you have no clue what it's saying. In the case of unstructured which is most of the data today. It's just lots and lots of units of something. Right. Numbers or it could be nouns, you know what I mean? It's like a collection of stuff. Information is when that data has meaning. Okay, so that's a real big distinction. And I know you know this, I'm saying this more for your listeners is, is, you know, actually, if you will indulge me for a second, I actually have something here which is kind of fun and I'm a big fan of the Beatles. I think you might know that.

Okay, yes.

Big, big influence on my life. So here's a little way of thinking about the difference and I'll come to the core of your question. So John Lennon is data. The fact that John Lennon is in a group, the Beatles, that's information. The fact that the Beatles are looking for a record deal is knowledge. The fact that the Beatles are very talented and popular and should get a record deal is wisdom. And finally, avoiding the decision making processes of DECA records is insight. And only people who know the Beatles well will understand that. So you see that in the abstract data is meaningless. So when we talk about information governance, there is an incredible overlap. No question. Yeah, you're going to have very similar stakeholders, you're going to have policies. You know, there's a lot of things are similar. But you do look at the information, the data through the lens of context.

Yes. So it has context. That's why it's called information.

Right, right. Like you're going to like if you, if I was a data custodian in it and I just had a database full of what looks like data and I, and the, and a stakeholder said to me, make sure that that is, that date is held on to for one year, I would say, or the custodian would say, cool, I will make sure it's. We held for one year. That would be different than if they, if the person came and said this is healthcare data. Now we got context. Right now patients, I want, we need to look at the rules and regulations governing healthcare data and ensure it's, you know, we, we, we keep it for the right amount of time, we dispose of it at the right amount of time. We have context to it. That's the difference between the two things. Okay, Huge overlap. Right, thanks.

Okay, but this reminds me of maybe a bit of a tangent here, but this is, I'm referring to work done by a guy called Daniel Erasmus who is able to showcase what you can do when you aggregate information together or aggregate data together. And it's actually proven that you can aggregate based on publicly available data information which is perceived to be company secrets. By piecing all the pieces together, look, you actually can aggregate to very valuable information, which in some cases is a company secret. So when you talk about the data governance and keeping it private or secure, in a lot of cases you assume that it's safe if you take away particular data. Like you mentioned, the healthcare set discussions. I don't want patient information in my healthcare. I do want to make the information available because I want to say we want to cure a disease, so we need that. You could say anonymized patient information.

Yeah.

This example of what Danielle showed me, could it be a potential that we assume that we've made the data anonymous, but we might have technology in the future which allows us to again link that information to the individuals involved. So when you talk about data governance, should organizations look at as is, should organizations look at what are potential future possibilities? So how can you perform data governance when. I'm just focusing on the privacy part, when you know that when you can imagine in the future you might be able to construct where the data came from, where you don't want that to happen.

Yes, this is a remarkably hard problem to solve. And as you describe it, it's a hard problem to solve. It's an easy problem to create. And more than most of us would appreciate certainly is the public within organizations. I think there's a better understanding of the possibilities. But I think we are quite innocent as individuals about how our data is being used. I saw an interesting statistic the other day. I hope I get this right. But somewhere in the region of over 300, organizations store our data, our personal data, as individuals, the average individual. And you know, you might look at one of the two of them or three of them and say, I, you know, you're like your bank. Hopefully you look at you, because you use online banking, you say, I trust my bank to take care of my data. Right. So there's going to be some that are like that, but the other 290, who knows? Right. So we, we are in a, a world and a period where we're sort of innocent and vulnerable about the potential. Now, the way I can answer this question a little bit is I don't have an answer in terms of how you actually fix that. And your colleague that you spoke about probably has good answers. The fact that data governance would force you to be aware of this and force you to be conscious as an organization around this is already a benefit the fact that you're thinking about, okay, we will anonymize data, but we will publish it. What are the risks? The fact that you're actually asking the question already is a positive.

Okay, now is that a role or is that a position where just the organization need to think about it, or is there also a role for governments and international institutes to play? Where there is would determine. Now you've gone too far. So you should not be storing this. Now, I'll give you a concrete example. Maybe you recognize it. But just very recently, I mean, we're in December, end of 22, it was in the news that in the States, a mother and a child wanted to attend a particular event. And through facial recognition, she was identified to work for a law firm which was prosecuting the firm. She wanted to attend as a private citizen with her kids, and she was bound to attend that event because, no, you are on the opposite team. You are not allowed to go. I mean, first of all, it's completely ridiculous that you're linking somebody's professional role to their private, you could say, desire to visit something. But the more fundamental question when I read that was, what is this organization doing in the first place storing that information, using it to track who's entering my event or not? And would this be a clear case where you need to have a government or an institute say, look, this is what you can do. This is what you can do.

Yeah, great, great example. So. Well, let's acknowledge, first of all that government already does this. Government already has rules, right? Of what? Of what data you can store. You know, I always go back to healthcare because we, we all understand healthcare data and here in the US we have a very rigorous law or an act. The, the, I guess it's the law, the HIPAA rule that, the Health Port and Information Portability act, which really has some very strict terms in how patient data can be used. Right? And so, yeah, government absolutely has a role. And that applies to lots of different things. You know, in terms of surveillance and what can be stored, even things like cameras in the street, the cameras that police officers now carry with them, how long that data can be stored, where it can be held, who can be shared with, how do you respond to media requests. So let's acknowledge, first of all that all of that already exists. It's not new. And in many ways I think you can make the argument it's probably going to grow. So there's law, which is this is, you know, this is what you could do, what you can't do. Straightforward. But there's another category here which I, which I think you'll appreciate, which is ethics. Right. And ethics is about the decisions we make and the behaviors we demonstrate. And I think the example you give, because maybe it's not codified in law specifically that the organization could do this. It comes down to is it ethical, is it the right thing to do? And that's obviously, that's a much grayer area and has a lot to do with ultimately the brand of the organization, what they believe, their philosophy, who they want to be. I mean, if they're using cameras to do facial recognition, to deny people entry to their, you know, events, and then they're using it to sort of deny a person who's there with their daughter, you could argue, well, let's hear their case. But you could certainly say that that's an ethical issue and has to be dealt with from a values point of view.

So far, Alice, I am assuming we've implicitly talked about organizations, single organizations within a single, say, legal entity, legal atmosphere, but we also know because of the way we're connected, first of all, data travels through different organizations and across boundaries. What does that do for data governance?

Well, it reinforces the fact that this is a really tough topic, that data is tough, that, you know, a hyperconnected digital world is presenting us with completely new problems.

Yeah.

That we, we haven't had to address before. And, and it means that every time we do use data in our organization, organization, anytime that data can find itself, you know, interfacing with another organization, you know, ultimately at that point we, we lose control over it. Do we have a decision mechanism in place to really, well, determine what we can interface with? And I will provide you with an example, too. So about eight or nine years ago, when I was the leading tech at the city of Palo Alto, we wanted to be part of the open data movement. So we basically, meaning we wanted to take government data, make it easily accessible to the community, publish it on a website, and then people could view it and they could download it. And mostly, by the way, in government, the vast majority of data is benign. It's like, it's not interesting. It's like it's boring. You know, you can have it. Who cares? Right. But there is a small part of it which is sensitive. You know, I'll give you an example, like the exact placement of power substations or, you know, something as simple as. I don't know what the correct political term today is, but manhole covers. Right. On a road. Right. Those are things which actually have a potential security risk. You know, people who want to do us harm or they can access infrastructure when they shouldn't. So you don't want to necessarily publish that quite as easily. So the question was, well, how do we have an active open data platform, continue to publish new data, but also be conscious of what could be risky? And so we put in place a process, a series of steps that validated every set of data before it was published. And in simple terms, basically, you have to review first of all, is it accurate data? You don't want to publish garbage. Is the quality good? Because fundamental in the core of data governance is quality data. Then is it protected data? And so now we would have, for example, our legal team take a look at it. Is it dangerous data? We'd have our emergency services director and maybe our public safety people look at it. And so you go through a series of steps. Ultimately, if everybody checks off that this is no problem, it gets published. But if there's a flag, then we are reserved and we have to go through more rigor and we might ultimately conclude that we're not going to publish it. Right. And so I think, you know, that, that, by the way, what I just described is data governance. And it was, we were doing it 10, eight to 10 years ago. And at scale, in large enterprises, you've got to be doing that. Everybody's got to be have a, you know, a data culture means that you think about this and it's part of how you operate. So, you know, what I worry about in the near term is even with that, we're going to get into trouble. You know, like, I think that's really the heart of what you're saying, is even if we try our best, the data is still going to be used in ways that we didn't anticipate. It's going to be meshed, you know, mashed up with other data and be used in ways we didn't expect. Some rigor early on will reduce that risk. And I think as the tools mature and how we handle data matures, this, we'll have other approaches to this problem.

Got it. Hey, Jonathan, we're almost at the end. I want to finish with your book. I mean, you no doubt have a copy with you if you can show that. So people start. I believe it's the number one book in a number of categories on Amazon. So it's.

That's right.

Congratulations with that.

Thank you.

I was wondering, I haven't had the book in my hands yet, but if I were, how many, how Often does the word accountability come. What's the frequency of the word accountability in your book?

I wish I'd done a little search on the PDF before we got on the podcast. Maybe you can put that in the. Pardon?

It is in there.

Oh, accountability is definitely in the book. Definitely in the book. Several times. Yes, yes. And if I get that for you, maybe you could put that into the podcast notes. You know, Jonathan got me the number for the amount of times it comes up. I'm pretty sure that there's an entire section called accountability. I'm pretty sure.

Good. So as an educator, as a teacher, I mean, this is one of your tools to transfer that knowledge. Now, you've already said at the beginning, this is going to be huge. This is big. Lots of organizations are investing in proper data governance. Do you think? I would say the general public is aware enough that we need to do something about this and make certain that we, you could say, define proper data governance for our organizations. And so that's the awareness question. And it does book because it's in the. For Dummy series. Now, I know that. That those books have not very nice. You could say, list checklists of things you can do.

Yeah.

So I'm assuming it's in there. But that does mean that you can follow particular generic guidelines to think about your own data governance.

Yeah, the audience typically are organizations for the book.

Yeah.

It's not really directed at the home, you know, the residential or the home market. Right. Or the. Just the private individual. Now, the private individual might be curious about the topic. And it's a good read, and it's an easy read, it's a fun read. But the primary audience is going to be organizational employees and leaders, folks in IT organizations, folks in the data groups at the C suite, legal auditors, financial folks. So it's got a big audience within the enterprise. If I could just say, what does data governance look like at home, in your house, especially as we. Well, I don't know that the podcast will be out before the holidays, but we're in the holidays right now and things like cyber attacks and fraud increase during these times. And so data governance at home means, you know, making sure that you back up your data on your home computers, your home tablets, on your smartphones regularly. Governance means that you have antivirus, anti malware software, you know, know where your data is, you know, know what, for example, services that you're. You've connected, let's say Twitter to or Facebook to, because they. You've probably clicked on a button that says you Give permission for your data to move from Facebook to another entity. You know, check that. So, you know, to your question, we have a responsibility as individuals and folks at home to manage the growing ecosystem of data we're involved with in a responsible way. And, you know, part of why you want to do that is you want to avoid the problems. You want to avoid the. The identity theft and the ransomware problems that might occur in your home. When I go into a classroom, whether it's my students or executives, and I say, hands up. Who backs up their smartphone every day? People don't put up their hand. And then I say, who backs up their smartphone every week? And there's less. There's very few hands. Eventually, if I say, do you back up at all? Some people put their hand up. The point is, we're not doing very good at this, even as individuals. And. And if I could sort of end on a. On a tip is, you gotta get that stuff in order. You gotta do that.

Jonathan, you just gave me a to do list during the coming holidays as well, so thank you for that. But you've made a very important point there. It's a very important topic, given the amount of data growth we are seeing at the moment. We need to make certain that we govern the data, because if we don't do that, we're going to hold a number of people accountable for not taking care of that data.

Yeah.

So, again, thank you for sharing your thoughts. We'll make sure that we'll provide a link to the book in the notes on the podcast. And again, thank you so much for your time.

Thanks, Fritz. This was so much fun. Thank you.