Schrems and Singing
This week we are stuck between the continuing strategic data implications of the Privacy Shield strike down and the almost certain meltdown in the Irish state exam system as result of listening to the Brits on the use of leveling algorithms to achieve equality of outcome. Nothing like listening to experts and Britannia, of whom we are no longer allowed to sing, would ever be an Ulsterman’s preference for equality modelling.
The Data Cold War
The Schrems decision, on the other hand is an interesting move in the geo-strategic game. The influence of the United States in the world is in decline. In that context, it might rue the day it thought extra territorial legislation was a good old wheeze. With China and the US the dominant tech producers and Europe the largest market, the EU has developed enviable alacrity in the use of regulation as tool in the cold trade war. Cynics might suggest that this is aimed at depriving other economies access to the EU market and encouraging local development.
So, as has been pointed out elsewhere in Castlebridge blogs there seems little hope that any foreseeable US government, or Chinese or UK government for that matter, is going to give up the benefits of wide spread covert surveillance of data. Acceptance by the EU of these policies being applied to both their citizens and their governments information is unlikely. Most EU national governments have developed polices to ensure that critical data remains in country and with companies not amenable to requests from other jurisdictions. And there is increasing calls for better oversight of EU intelligence agencies in their gathering and use of data.
The view from the boardroom should consider both the environment and market fundamentals in developing strategy. When data transfers beyond the EU become an issue for the continued running of the business, localising data must be considered. Relocation will become a favoured solution in application areas where an existing locally based solution is available.
Shop Local ?
In fact, for many years Castlebridge has recommended that clients use best of breed suppliers based in the EU. We use EU based tools ourselves for email marketing, project management, and helpdesk management. For application areas and solutions for which are business critical for particular clients, standard contractual clauses or other forms of remediation may be possible. There may however be other areas, such as banking and payments which will require government or EU wide solutions. But localisation of supplier is one part of the solution. Divorcing data from transfers to less savoury jurisdictions may require the development of EU/EEA based networks.
This is an increasing trend in the rest of the world where countries are taking the decision to divorce or separate from the US payments infrastructure. There is good reason why the government of Singapore does not permit its banks to hold US licenses. Of course the outfall of Brexit will bring a new focus to European Banking. So the chance of a confluence of change drivers may accelerate this process.
In the meantime, CEOs need to be aware of the potential new risks the removal of Privacy Shield will bring. They will also consider the trend towards localisation of data. While it is business and the market that set overall strategy, the organisation data strategy is an integral part of the adding value process in the data driven world. Current market trends are converging on localisation and valuing customers. In data terms this means increasing the level of trust in our use of data. This requires a recognition of their value to us, and leveraging this to drive innovation and growth.
Data transfers are only one small but important part of the overall data strategy. The combination of the changing focus on strategic data usage combined with the new normal environment we have emerged into from lockdown means that we must realign our data strategies. The new strategic environment is more connected and less ‘face to face’. We need to work out how to do this safely with a minimum of unintended consequences.