Estimations of the value of the digital economy range from nearly 3 trillion dollars to 8 trillion on the high end. Given the already significant size of the digital economy and the anticipation that it will continue to grow at a breakneck pace, it is little wonder that all eyes are now beginning to focus on the one resource without which economic growth would not be possible: data. Survival and growth in the digital economy is and will be a function of how effectively today’s businesses can leverage their data assets to create the kinds of digital goods and services that continue to add value to the world economy. In this short series (this is part two), we examine the following: 

• Part one: challenges of monetizing personal data
• Part two: steps to monetizing personal data 
• Part three: a data monetizing toolbox for you

In the first installment of this series we described several unique characteristics of personal data that present challenges to companies looking for ways to monetize it. These unique characteristics of personal data (e.g., highly regulated, unstructured data elements, ownership questions) must be addressed if companies are going to capitalize on the promise of predictive and performative analytics to extract value from their personal data assets. Any solution to the challenges to monetizing data assets will require companies to execute two basic sets of operations prior to performing any analytics: data discovery and data aggregation. While these operations will not resolve all of the company’s data monetization challenges, they are critical steps that must be performed if companies want to make the most of their efforts to monetize personal data.

When taking steps to prepare for data monetization, companies should consider the following:

First, locate all identifiers: Personal data is everywhere. Selecting a tool or set of tools that can scour your company’s structured and unstructured data repositories, including data in cloud repositories and IOT devices (unique and valuable data can be found in these stores) is the first step. There are tools on the market that have varying capabilities companies can use to discover where their personal data assets are located and what specific data elements are contained in those repositories. The more exhaustive the discovery operation, the better the opportunity to create rich data sets from which revenue generating insights can be created.

Then, consolidate identifiers to the right identities: Once the company has identified the personal and metadata elements within its structured and unstructured data stores, the next operation is to consolidate these discrete personal and metadata elements with the right personal data record or identity. While there are regulatory considerations that must be considered prior to simply consolidating this data, there are steps and considerations the company should take before using the data for monetization purposes. Companies can sanitize the data to meet some of the above-mentioned privacy related requirements via techniques such as filtering, cleansing, pruning and conforming. Companies can also weigh or risk-rate various sources of data (e.g., elements pulled from social media may have less reliability than elements on a job application form) to better project the value of any correlations derived from analysis of the data.

The consolidation of the identifiers to the right identity is not simply a matter of attaching John Smith’s medical images to John Smith’s record, it’s also a matter of ensuring that the John Smith to whom the medical image belongs is not attached to another individual named John or J. Smith. Companies need tools that can effectively associate or match the right data elements with the right identity. It helps the company to identify the specific set of regulatory obligations and other commitments that may restrict the use of the personal data and, just as importantly, it ensures that any patterns or correlations derived from the analysis of the data is based on as complete, accurate and up-to-date information as possible. 

Now apply the right metadata to the identities: Data discovery and the consolidation of identifiers do not, on their own, identify the regulatory requirements that govern the data. The secret to accurately tagging identities with their obligations is in associating the identities with the metadata that their processing generates. Metadata is the information systems generate about the who, how, where and when concerning their operations (i.e., the data about the data).  Metadata can contain important information that can help the company address a variety of issues including data quality, regulatory restrictions, and obligations the company has to the data subject vis-à-vis contracts, privacy notices and/or consents related to the use of the data.

Some of the key types of metadata that companies would want associated with identities so that issues like consents, notice-based restrictions, cross border restrictions and data quality matters are addressed include, but are not limited to:  

• Geographical location of systems and users;
• Dates records were created, last accessed and updated;
• Source of data (e.g., data subject, employer, data broker);
• Collection point with specific privacy obligations (e.g., website, application, function-specific form, purchase), and
• System of record with specific privacy obligations (e.g., EHR vs CRM).   

While there is no simple solution, this information will help companies remain lawful when taking steps to monetize personal data because it will help them to identify which data elements or records should be de-identified or anonymized prior to aggregation or prior to conducting analytics. 

Voila! Behold the results: Once the above operations have been executed, the business's personal data assets are ripe for monetization. From a breadth perspective, the business now has a true understanding of the volume and categories of unique identities in their data stocks. From a depth perspective, the consolidation and association of vast amounts of information with each identity provides much richer, and hence more value-laden, individual profiles. In addition to a firm grasp of the volume and richness of the personal data assets, consolidation makes it much easier to update the record over time when new or amended bits of information have been provided by the data subject or generated by a business process. Further, application of the right metadata to the identities allows the business to know in advance what is permissible or impermissible with respect to what can and cannot be done with a personal information record. The benefit here is not simply that the business now has the ability to select which identities can be used for which purposes, but it also provides a roadmap to the business to know which of the data elements associated with the individual (e.g., medical or financial records) must be de-identified or obfuscated before it can be used for the purpose of monetization. 

Now that the business has a fact-based understanding of its personal data assets that includes an understanding of the true parameters of what can and cannot be done with this valuable data asset, it’s time to begin making plans to creatively monetize the data. 

As companies begin preparations to create value from their data assets, there will be a growing demand for effective tools that can help with the operations of discovery and aggregation. The tools will have to be not only data-aware like traditional DLP solutions, but identity aware.

In the final installment of this series, available in next month's Privacy Advisor, we will explore the promise of these new identity aware solutions.

photo credit: Research Data Management via photopin (license)