Can compliance help you compete?

Taking privacy beyond compliance can be a data strategy enabler

  • Share

Privacy is not only a compliance issue. It’s strategic!

Leading organizations are placing greater strategic importance on advanced analytics, and they’re investing in the people and resources to embed it more deeply into business decision-making.

A recent survey conducted by EY and Forbes concluded that the drive and need to capitalize on advanced analytics is being fueled by fundamental changes resulting from new digital technology. Among the most impactful to the global enterprises surveyed are the rise of the Internet of Things, increased concerns and regulation surrounding data privacy and security, and the shift of IT resources to the cloud.1

While big data promises significant economic and social benefits, it also raises serious privacy concerns.

In particular, big data challenges the Fair Information Practices (FIPs), which form the basis of all modern privacy law. Probably the most influential privacy law in the world today is the General Data Protection Regulation (GDPR). But while the GDPR addresses issues related to targeting, profiling and consumer mistrust, it relies heavily on a discredited informed choice model, and therefore fails to fully engage with the impending big data tsunami.

With the vast amount of personal data that’s in cyberspace, consumers are becoming more aware of that information is out there about them. As a result, organizations need to step up and be more transparent about consumers’ online lives, provide options for them to own their data and restrict the use of their data, and obtain explicit consent for each purpose for which their data will be used.

Organizations that want to reap the significant economic and social benefits advanced analytics can bring need to create a data privacy strategy that goes beyond compliance.

The strategy must combine legal reform with the encouragement of new business models that are premised on consumer empowerment and supported by a personal data ecosystem.

The new strategy is important because it changes the focus of who benefits from the collection and use of personal data from businesses to consumers. It also increases consumers’ trust by giving them control over how their data is collected and used while still benefiting from the use of big data.2

So how can organizations shift their data strategy from creepy to cool?

Some options include building real-time consent into their business processes, investing in technology to support User Managed Access and privacy by design, and using digital personas to provide products and services.

Innovative Data Strategy

Real-time consent3

A leading-class strategy in building customer trust is transparency during the consent process. This includes giving customers access to means that allow them to exercise control over the use of their personal data at the time the data is used.

User Managed Access4

User Managed Access is an OAuth-based access management protocol standard. It’s designed to enable an individual to control the authorization of data sharing and access to other protected resources.

Privacy by design

Organizations can consider designing data protection into the development of business processes and new systems. Privacy settings are set at the highest level by default. For designers and developers to use privacy by design or privacy by default methodologies, practical and implementable procedures must be available.

Digital personas

A digital persona is a realistic representation of consumer groups that are based on research and data. These personas are developed using aggregated customer data from a variety of sources — such as website analytics, online surveys, social media use among others — to advise on the creation of groups of personas that represent the organization’s digital customers.


The pace of business transformation is rapid for most organizations, driven by market insurgents, new customer demands, technology innovation and other factors. To stay competitive, leading enterprises are using advanced analytics to improve current business processes and answer the fundamental question, “What’s next?” when it comes to what to sell, how to sell, who to sell to, and how to outflank the competition. Those that are not making progress quickly enough are at an increased risk of falling behind both current competitors and emerging players that were “born” digital with advanced analytics at the centre of their strategy.1

Organizations that strategize the use of advanced analytics, also need to seek a forward-looking data privacy strategy that incorporates customer rights, ethical use of data, and legal and compliance obligations. This will give organizations a competitive advantage in building trusted relationships with their customers while reaping the significant economic and social benefits of advanced analytics.

1 High stakes, high rewards: data & advanced analytics in Canada, Forbes Insights, EY Canada, 2016.
2 Ira Rubinstein, Big Data: The End of Privacy or a New Beginning?, 5 October 2012, International Data Privacy Law (2013 Forthcoming); NYU School of Law, Public Law Research Paper No. 12-56. Available at SSRN: or
3 Office of the Privacy Commissioner of Canada, Draft guidelines: Obtaining meaningful online consent, 2017, accessed via, April 2017.
4 ISACA Journal, “Transforming Data,” Volume 6, page 20, 2017.