Boardroom Insiders CEO Sharon Gillenwater discussed the top of mind issues for CIOs due to the pandemic. Initially, the CIOs’ focus was on transitioning to work from home along with tightened security. There were also “stepped up initiatives around cloud, automation, and e-commerce in order to keep the business running. In fact, COVID-19 did more to speed up their digital transformation plans than anything else in recent history.”
“You can’t speed up the culture of an organization. You can roll out technology maybe faster… You have to be careful about speed over perfection. Speed is one thing, but you have to make sure that you don’t introduce any security risks, so it’s sort of combining those two things together [that] I think is extremely important at this time.”
Box CIO Paul Chapman
The Boardroom Insiders research team spent two weeks reviewing recent CIO interviews and identified five positive by-products of the pandemic that are improving the resiliency and capabilities of the enterprise. First off, tech leaders have emphasized upskilling and reskilling their teams to address skills gaps. Tech vendors have rolled out “a whole host of free training and education programs.” As these programs are virtual, CIOs are encouraging their staff to attend these sessions with zero travel costs and registration fees.
Likewise, CIOs are using the time at home to hone their leadership, communication, and team engagement skills. CIOs have found their teams to be more productive, collaborative, and agile, with rising morale.
The third silver lining is the acceptance and integration of new tools into business workflows. Many of these changes were a necessity due to operational dislocations, but these new tools are “driving new levels of productivity and employee self-service across the enterprise.”
The work from home experience has also served as a “future of work lab” which forced executives and managers to “rethink business processes.” This rethinking has “driven a wave of innovation internally” and let management observe how a remote workforce behaves. This forced experiment has helped CIOs “map out a vision of what the future of work should really look like at their companies.”
Finally, the pandemic has encouraged CIOs to test and revise their business continuity plans and enhance security tools and protocols, readying the firm for the next crisis.
Gillenwater described the current situation as a balance between navigating COVID and growth-focused initiatives:
Evolving work-from-home into a long-term roadmap for the future-of-work
Enabling security everywhere and agile/mobile/digital/cloud everything
Scenario and business continuity planning, in an attempt to plan for future changes and challenges
Accelerating digital initiatives, at a pace that many say they’ve never seen before
Cost cuts/expense management, an inevitability in an economically trying time
Reprioritization and refocusing of IT investments and projects
eCommerce, as part of the rush to digitize
Innovation, to identify and capitalize on future opportunities
Speaking at the 40th International Conference of Data Protection and Privacy Commissioners (ICDPPC), Apple CEO Tim Cook forcefully called for expanded global privacy protections akin to GDPR:
Our own information — from the everyday to the deeply personal — is being weaponized against us with military efficiency. These scraps of data, each one harmless enough on its own, are carefully assembled, synthesized, traded and sold. Taken to the extreme this process creates an enduring digital profile and lets companies know you better than you may know yourself. Your profile is a bunch of algorithms that serve up increasingly extreme content, pounding our harmless preferences into harm…
We shouldn’t sugarcoat the consequences. This is surveillance…
We should celebrate the transformative work of the European institutions tasked with the successful implementation of the GDPR. We also celebrate the new steps taken, not only here in Europe but around the world — in Singapore, Japan, Brazil, New Zealand. In many more nations regulators are asking tough questions — and crafting effective reform.
It is time for the rest of the world, including my home country, to follow your lead.
We see vividly, painfully how technology can harm, rather than help. [Some platforms] magnify our worst human tendencies… deepen divisions, incite violence and even undermine our shared sense or what is true or false.
This crisis is real. Those of us who believe in technology’s potential for good must not shrink from this moment…
They may say to you our companies can never achieve technology’s true potential if there were strengthened privacy regulations. But this notion isn’t just wrong it is destructive — technology’s potential is and always must be rooted in the faith people have in it. In the optimism and the creativity that stirs the hearts of individuals. In its promise and capacity to make the world a better place.
It’s time to face facts. We will never achieve technology’s true potential without the full faith and confidence of the people who use it.
He also warned about the dangers of AI which fails to protect privacy:
Artificial intelligence is one area I think a lot about. At its core this technology promises to learn from people individually to benefit us all. But advancing AI by collecting huge personal profiles is laziness, not efficiency.
For artificial intelligence to be truly smart it must respect human values — including privacy. If we get this wrong, the dangers are profound. We can achieve both great artificial intelligence and great privacy standards. It is not only a possibility — it is a responsibility…
Yesterday, Cook tweeted that privacy is a human right
based upon four principals:
Data Minimization – Personal data collection should be minimized or de-identified.
Transparency – Individuals have the right to know what is being collected and for what purpose.
Right to Access – “data belongs to users” with personal data available to individuals for copying, correcting, and deleting.
Right to security – “security is foundational to trust and all other privacy rights”
A few weeks ago, I wrote about enterprise software vendors calling for an American version of GDPR with Microsoft announcing that it was building GDPR into its global product line as its standard privacy protocol.
On the Salesforce earnings call last week, CEO Marc Benioff observed that the software industry has been going through a “crisis of trust for the past six months” related to privacy and data ownership:
“From the European perspective the way they look at data is data belongs to you, it’s your data. Now for us at Salesforce, we understand that. We’ve had that position from the beginning. Our customers’ data belongs to them, it’s their data. I think in some cases, the companies that are start-ups and next generation technologies here in San Francisco, they think that data is theirs. I think the Europeans with GDPR have really flipped the coin, especially in advertising but in another areas saying hey, this data belongs to the consumer or to the customers, you guys have to pivot back to the consumer, you have to pivot back to the customer.”
Benioff once again called for a US privacy law similar to GDPR which provides “guardrails” around trust and safety. “This is going to help our industry,” said Benioff. ”It’s going to provide the ability for the customers to interact with great next generation technologies in a safe way.”
Benioff also warned that when AI technologies are indistinguishable from humans, trust will also be an issue.
It is less than 36 hours until GDPR becomes the law of the land in the EU Zone. As the regulation has extra-territorial privacy requirements, non EU companies, even those without a physical presence in the EU, are subject to its requirements with respect to communications with EU citizens and management of their data.
The US has a much weaker set of laws and there is concern that US firms are laggards with respect to compliance. However, a number of US technology firms have called for adoption of a US GDPR.
On Monday, Microsoft once again reiterated its belief that “privacy is a fundamental human right” and announced that GDPR will be their privacy standard globally.
“As people live more of their lives online and depend more on technology to operate their businesses, engage with friends and family, pursue opportunities, and manage their health and finances, the protection of this right is becoming more important than ever.”
Julie Brill, Microsoft Corporate VP & Deputy General Counsel
Companies, therefore, have a “huge responsibility” to protect and safeguard personal data.
Since GDPR was enacted in 2016, Microsoft has dedicated 1,600 engineers towards compliance. “GDPR compliance is deeply ingrained in the culture at Microsoft and embedded in the processes and practices that are at the heart of how we build and deliver products and services,” said Brill.
She noted, however, that GDPR is a “complex regulatory framework” subject to “ongoing interpretation” by regulators and feedback from customers. As such, the firm will “determine the steps that we all will need to take to maintain compliance.”
As a provider of corporate infrastructure, Microsoft views GDPR as an opportunity to differentiate itself and assist its customers with compliance on the Microsoft Cloud. “One of our most important goals is to help businesses become trusted stewards of their customers’ data,” said Brill. “This is why we offer a robust set of tools and services for GDPR compliance that are backed up by contractual commitments. For most companies, it will simply be more efficient and less expensive to host their data in the Microsoft Cloud where we can help them protect their customers’ data and maintain GDPR compliance.”
Salesforce and SugarCRM have also taken a strong position on GDPR calling for similar legislation in the US. “What we need is a national privacy law, and that will really not just protect the tech industry; it’s going to protect all the consumers,” said Salesforce CEO Marc Benioff.
This is not a new position for Salesforce. Back in 2014, Benioff said, “I’m all in favor of consumers having more power and more control over their data. As a consumer, you should have all of the rights. It’s like a cloud Bill of Rights. As a consumer or as an enterprise, you should have the right to be forgotten or to add or take away your data.”
As part of its compliance, the firm named their Senior VP of Global Privacy and Product Legal Lindsey Finch as their new Data Protection Officer. Finch has been with Salesforce for a decade with previous stints at GE (Privacy Counsel), the Federal Trade Commission, and Homeland Security.
“The official DPO designation is a natural outgrowth of our existing programme. My team and I will continue to partner across the company to foster a culture of privacy – designing, implementing, and ensuring compliance with our global privacy programme, including ensuring that privacy is considered throughout the product development lifecycle,” said Finch. “The top theme I’m hearing is that our customers are using the GDPR as an opportunity to focus on their privacy practices and putting their customers—oftentimes end-consumers—at the center of their businesses. The GDPR is a complex law, but putting the individuals to whom the personal data relates at the forefront, and focusing on their expectations and preferences, is a great starting point for compliance with the GDPR and other privacy laws.”
Finch described Salesforce’s approach to GDPR compliance:
“We started by kicking off a thorough review to ensure compliance across the company. The GDPR is an incredibly rich document—99 articles and 173 recitals across 88 pages! Our Privacy team broke this down into key principles and worked closely with our Technology & Products organization to review our compliance. We found that we were already in a really great place,
Since then, a lot of the work we’ve been doing has been to document how our customers can use our services to comply with some of the key GDPR principles, which we’ve published on our GDPR website. There is no finish line when it comes to GDPR compliance. While Salesforce currently offers the tools for our customers to comply with the GDPR, we will continue to release new innovations that help our customers achieve compliance success.”
Salesforce CMO Simon Mulcahy echoed Benioff and Finch at the Salesforce World Tour event in London last week. Mulcahy stated that many companies simply view GDPR as a compliance issue and nuisance, not an opportunity to align company interests with customer desires. “It is a compliance issue, but it’s also a phenomenal opportunity to give your customers what they want. What they want is to know that when they give you their data, you’re looking after it appropriately.”
“Benioff is right that we will need some regulation and I can’t see how we can set two standards–EU and US–so we’ll likely need to adopt what the EU has done or risk chaos. This also fits well into the narrative of the information utility. GDPR is another driver sending us toward utility formation for the information industry.”
Dennis Pombriant, Principal Beagle Research
Larry Augustin, CEO of SugarCRM noted that firms have been lax in their privacy and cyber security processes saying that self-regulation has proven to be insufficient with “too many incidents.”
“Data privacy issues are not going to go away. People are thinking a lot here now about GDPR, because Facebook, Twitter, and all of these issues keep coming. And Experian in the US, about managing personal information related to credit card data… there’s just a constant barrage of issues around data privacy and personal information,” continued Augustin. “Everyone has to address it, whether it’s in the context of GDPR or the next thing that’s going to come along. There is definitely a heightened awareness and interest.”
SugarCRM has built a data privacy manager into its CRM as a “command center” for the data privacy officer.
In my discussions with clients. they all admit to the regulations being a muddle that initially adds risk to their business models. The penalties are draconian, but the compliance requirements are ambiguous, particularly for B2B firms. As such, we are likely to be hearing about issues concerning GDPR compliance requirements over the next few years.
Microsoft CEO Satya Nadella digressed from standard earnings call topics two weeks ago to discuss the importance of ethics, privacy, and cybersecurity. While he did not provide a specific reason for the digression, the Facebook hearings and impending GDPR implementation were likely motivators.
Nadella noted that the intelligent cloud and intelligent edge are “tremendous opportunities” for Microsoft customers, but that it is critical that both Microsoft and its customers “ensure trust in technology” across three dimensions: privacy, cybersecurity, and ethics. Nadella argued that “privacy is a fundamental human right” and that the firm has implemented an “end-to-end privacy architecture” which is GDPR compliant.
“For customers, we will provide robust tools backed by our contractual commitments to help them comply with GDPR,” said Nadella. “In fact, for most customers it will be more effective and less costly to host their data in Microsoft’s GDPR-compliant cloud than to develop and maintain GDPR compliance tools themselves.”
With respect to cybersecurity, the company spearheaded a coalition of 34 global tech and security companies for the Cybersecurity Tech Accord, “an important first step by the industry to help create a safer and more secure online environment for everyone.”
Nadella also announced the establishment of an AI and Ethics in Engineering and Research Committee at Microsoft “to ensure we always advance AI in an ethical and responsible way to benefit our customers and the broader society. This includes new investments in technology to detect and address bias in AI systems. Microsoft stands for trust, and this will continue to be a differentiating focus for us moving forward.”
Up until recently, information technology and social media have been viewed as social goods with few drawbacks, but now that we are all tied into the social communications fabric, we are beginning to worry about the dark side of such connectivity whether it be job losses through automation, the stripping away of privacy, the vulnerability of our networks to hacks, or the undermining of objective truth and democratic systems.
One step towards addressing these problems is the GDPR Chief Privacy Officer requirement with its focus on privacy and cybersecurity. At most companies, this role is likely to be one of compliance, not ethics or broader social questions. At a few, however, this role may grow beyond mere compliance and begin to address the broader social and economic issues posed by information technology.
The US 1950’s Civil Defense training film “Duck and Cover” taught school children to “duck and cover” if there were a nuclear flash. (Public Domain)
Thinking back on the Hawaii emergency management snafu (a WWII acronym meaning “Situation Normal: All F****d up), it was clear that they lacked proper controls and situational planning. Apparently, there were no controls to prevent routine tests from sending out real messages. Furthermore, there was no redundancy in the system (e.g. confirmation messages, secondary approvals) and no plan for immediately recalling the message. Supposedly, the governor couldn’t Tweet because he forgot his password.
So, Hawaii was sent into a panic.
This just points out that emergency plans need to be periodically reviewed (what better time than Q1?). Do we have proper backups and system redundancy, state of the art firewalls and virus detection, and plans for managing and communicating hacks? Can we manage operations if a key partner API crashes or content partner shutters? Have we run through PR nightmare scenarios such as the one that H&M recently suffered (and which resulted in their South African stores being vandalized)?
There is no lack of risks (data security, physical security, financial, brand, supply chain, key executive health). Most are highly unlikely. But we’ve seen information services firms suffer problems over the past few years including the theft of the D&B NetProspex contact file from a data licensor and the Equifax hack. So, while many seem remote, the lack of scenario planning makes them more likely and costlier.
Of course, risk planning and mitigation need to be realistic. If it is simply a “Duck and Cover” campaign for PR purposes, then it will do little to prevent the risk or manage the situation should the emergency happen. Emergency planning needs to be robust.
Emergency planning suffers from some of the same issues as data quality. Both are boring investments based upon reduction of hypothetical risks and costs. But part of a C-level executive’s mandate is to plan for business continuity and mitigate risk.
Openprise provides fine-grained data filters and permission roles
Data automation vendor Openprise announced support for the EU General Data Protection Regulation (GDPR) which goes into effect on May 25th. The new Openprise Data Orchestration Platform capabilities provide “visibility, control, and access management inside and outside of a company, without the added complexity of traditional compliance solutions.”
The GDPR specific functionality “controls the flow of EU data out of your company” via “fine-grained data filters and permission roles,” and flags leads and contacts which are subject to the GDPR even if the records lack country flags. The firm performs checks based upon emails, IP addresses, phone numbers, and non-standardized country fields. Both standard and custom fields in sales and marketing automation platforms are GDPR validated. Openprise maintains an audit trail and logs records which have been processed by partners.
The firm noted a Catch-22 in GDPR regulations. Enriching records that lack country designators may require enrichment from non-compliant datasets, violating the law. By utilizing data from within the record (e.g. domain, phone numbers), Openprise avoids violating the law in order to support the law.
“The vast majority of US-based companies are woefully unprepared for GDPR, and this new set of regulations has teeth. We’ve heard from our customers that they want a central control point to help maintain compliance with GDPR. Openprise’s position in the MarTech stack as the conductor that manages the movement and processing of data across systems puts it in a unique position to serve as this control point.”
Openprise CEO Ed King
The GDPR is broadly written to cover data held by non-EU companies, even those without operations or sales staff within the EU. Penalties can be quite high, reaching up to 4% of revenue or €20 million, whichever is greater.
“What’s so critical about GDPR is that it affects companies everywhere in the world, whether they have a presence in the EU or not, and unlike many other regulations, this one has teeth,” says Allen Pogorzelski, vice president of marketing at Openprise. “If you’ve got EU citizen data in your databases, you’re subject to GDPR regulations. U.S. companies that ignore these regulations do so at their own peril.”
This summer, Openprise launched a Data Marketplace to assist with ingesting and normalizing third-party B2B and B2C data. Amongst the platforms supported are Salesforce, Marketo, Eloqua, and Pardot. The Data Marketplace, part of the Openprise Data Orchestration platform, includes built-in rules to ensure data are properly onboarded. B2B Partners include Zoominfo, InsideView, Orb Intelligence, Synthio, Salesgenie, and Dun & Bradstreet.
On May 25, 2018 the EU General Data Protection Regulation (GDPR) goes into effect, creating data privacy and security concerns for firms both inside and outside of the EU. The GDPR covers both companies that provide goods and services to EU residents and those that are part of the value chain. The regulation covers all individuals domiciled within the EU, regardless of where the company is headquartered.
According to Forrester, the regulation has five key requirements:
If a firm has “regular, systemic collection or storage of sensitive data,” they need to hire or designate a Data Protection Officer (DPO). The function may be filled by individuals with legal, privacy, security, marketing, or customer experience. The International Association of Privacy Professionals (IAPP) estimates that the regulation will require 30,000 privacy officers. The DPO will need to work with security leaders with respect to identity and access management (IAM) and encryption. They will also be involved in purchasing decisions around CRM, analytics, and other platforms.
Should a data breach occur, firms have a-72 hour window for reporting breach details to the authorities and customers. The window begins as soon as the breach is detected.
Privacy must be built into any new projects with a “Privacy-by-design” philosophy. Forrester stated that “sustained collaboration between teams will be critical, so firms will have to establish new processes to encourage, enforce, and oversee it.” For example, privacy officers will need to review business requirements and development plans related to new apps.
Extraterritoriality places requirements on firms outside of the EU, making it a global requirement. Forrester notes that “a US-based data aggregator that collects and resells EU customers’ data to other business partners will need to comply fully with GDPR requirements, rather than simply meeting international data transfer rules.”
Firms will be responsible not only for securing data but providing evidence that they have implemented appropriate risk mitigation. Thus, a firm can be held in violation even if they have not had customer complaints or data breaches.
US companies are still obligated to comply with the 2016 Privacy Shield agreement between the US and EU. Forrester also warned UK firms to comply with the GDPR as lowering British privacy standards would only serve to complicate UK-EU data transfer rules post Brexit.
Forrester suggested that firms take a cost-benefit analysis to data instead of simply storing everything:
“Firms will learn to better assess the costs and benefits of records they process, store, and protect. They will progressively focus on collecting, buying, processing, storing, and protecting only the data that offers them the most value and will kill the rest.”
Forrester also suggested that privacy should be part of a firm’s DNA and some firms will integrate privacy into brand perception and the customer experience, providing a basis for competitive advantage.
Osterman Research conducted a survey of mid to large companies subject to the law to identify technology expenditure increases for GDPR compliance.
GDPR non-compliance costs are potentially very high with penalties up to the greater of €20 million or 4% of total worldwide annual turnover of the preceding financial year.
A NetProspex breach sample record for journalist Zack Whitaker (originally published by Troy Hunt with permission)
A 52.5 GB NetProspex file of nearly 34 million US business contacts was recently stolen. Dun & Bradstreet did not indicate how the MongoDB database was purloined, but indicated it suffered no data breaches and the file was likely stolen from a customer. “We’ve carefully evaluated the information that was shared with us and it is of a type and in a format that we deliver to customers every day. Based on our analysis, it was not accessed or exposed through a Dun & Bradstreet system,” the firm said in a statement to ZD Net.
The file was believed to be six months old. While it was built and sold for legitimate sales and marketing purposes and complies with US law, it could be used for spamming and spear phishing. “It’s an absolute goldmine for phishing because here you have a huge amount of useful information from which to craft attacks,” said Internet security advocate Troy Hunt who publicized the breach. “From this data, you can piece together organizational structures and tailor messaging to create an air of authenticity and that’s something that’s attractive to crooks and nation-state actors alike.”
Content includes business contact information; job titles, functions, and levels; current employer; and employer firmographics including size, industry, location, and D-U-N-S Number. Their file does not contain personal emails, phones, biographics, or any kind of consumer credit data as Dun & Bradstreet strictly collects B2B company and contact intelligence. However, the file does contain extensive business and government employee data such as 100,000 Department of Defense and a combined 75,000 Army, Air Force, and VA contacts.
Dun & Bradstreet should evaluate whether retaining titles for military and security agencies is in their best interest (and the country’s). For example, being able to identify 715 military Intelligence Analysts makes it easy for nefarious parties to spearphish them. This may be a case where losing the actual job title and simply mapping the title to a job function (e.g. procurement, security, medical, R&D) would make sense. Another option might be to track only government officials whose name appear in official sites and publications. As the government publishes bid data through FedBizOpps, procurement contacts would still be available for commercial purposes.
“Whilst you could piece together parts of the data from information already in the public domain, having it aggregated and so easily searchable in this fashion is enormously valuable,” said Hunt. “It also serves as a reminder that we’ve lost control of our privacy; the vast majority of people in the data set would have no idea their information is being sold in this fashion and they certainly don’t have any control over it.”
If you would like to check on whether your personal or business email information have been stolen, Hunt has setup a free site which tracks over 200 stolen databases. Registration takes about 3 minutes (you need to validate that you are researching your own contact information). The site will also advise you if your email appears in future breaches.
It is less than 36 hours until 
