In the first two installments of this series, we described some of the unique characteristics of personal data that problematize efforts to monetize this value-laden asset and then outlined some key steps companies could take to address these challenges. In the third and final installment of this series, we will briefly explore how a new wave of technologies can help companies prepare their data assets.
The difference between "data-aware" and "identity-aware" solutions
Many companies already deploy information-security solutions that are data-aware. These solutions are tools for automated classification of data, data-loss prevention and network-based data organization solutions, and they enable companies to scan the IT environment for repositories containing a pre-programmed set of data characteristics or key words (e.g., strings of nine digits for SSNs or 16 digits for credit card information).
Data-aware solutions cannot help.
Data-aware technology can be very effective in helping to classify and to apply appropriate security controls to the company’s data assets. However, they cannot perform the specific data discovery, aggregation and metadata matching operations that would enable the company to assemble rich personal data sets that could be optimally monetized. In other words, data-aware solutions cannot by themselves reach down to the identity-level of the data, aggregate disparate pieces of personal information from data stores across the enterprise, and associate these records with their concomitant privacy obligations. Even when supplemented with surveys and questionnaires, data-aware solutions are limited in their ability to identify the specific privacy obligations associated with each record.
Identity-aware solutions of old are limited at best
Identity-aware solutions enable companies to track and apply discrete privacy obligations to an individual data subject. Solutions that track identities have been around for more than 20 years, largely for addressing marketing communication purposes. Although such traditional identity-aware solutions go beyond their data-aware counterparts by tracking and applying specific obligations to a given data subject, these identity-aware solutions are still severely limited if pressed in the service of monetizing the company’s personal data assets. More specifically, these solutions are limited by complex IT environments with structured and unstructured data stores strewn haphazardly across the network. Therefore, these solutions would need to be supplemented by any number of other solutions to create a comprehensive and consolidated individual level inventory of the company’s personal data assets.
However, in recent years, several new technology companies have developed innovative next generation identity-aware solutions that rely on machine learning and artificial intelligence. These go well beyond the capabilities of both data-aware and traditional identity-aware solutions to enable companies to meet both their data privacy compliance requirements and the goal of monetizing their personal data assets.
Today's identity-aware solutions
- Inventory to scale: Next generation identity-aware tools are equipped with machine learning and artificial intelligence capabilities that allow the tool to move quickly from one repository to another to discover the disparate elements of personal data and then consolidate these elements with the unique individual’s record. In essence, these new solutions enable the business to rapidly create a detailed and comprehensive personal data inventory that can be leveraged for purposes of monetization and compliance.
- Complex IT environments: Companies have vast and sometimes incomprehensible amounts of personal data elements scattered across their IT environment. These data elements can be stored in a wide array of structured and unstructured repositories, including data stored in the cloud and data stored in IoT devices. Next generation identity-aware tools are the only solution on the market that can operate with any amount of efficiency at the identity level. Indeed, whereas data-aware tools would have to build personal data inventories one identity at a time (e.g., search the repositories for ‘John Smith’), these newer identity-ware solutions have no such limitation as they work at the identity level across complex structured and unstructured environments to compile millions, perhaps billions, of identities at a time.
- Obligations to scale: In addition to creating personal data inventories to scale, next generation Identity Aware solutions have the ability to scale associated privacy related obligations to each of the records in the inventory. Once these obligations have been attached to each identity, the business now has a view of which identities and which elements associated with these identities can be used to monetize the asset. Neither Data Aware nor traditional Identity Aware solutions can track and manage these obligations to scale. Data Aware solutions simply do not function effectively at the identity level.
- Data quality: As a general rule, monetization of personal data assets depends on providing data scientists with rich profiles that contain accurate, fresh and complete records. The next generation of Identity Aware solutions are uniquely positioned to enable companies to meet each of these data quality needs. These Identity Aware solutions can scan through multiple systems and identify disparate data elements stored in different formats and associate these elements with the appropriate identity. These capabilities enable companies to create as complete and as accurate a set of personal data sets as technically feasible. Identity Aware solutions have the added benefit that they can identify the last time a record was updated to prevent the use of stale data when performing analytics on the company’s personal data assets.
Monetization is within reach
Over the course of this three part series, we have covered three key steps that a company must take to effectively prepare their data sets for monetization; (1) data discovery, (2) consolidation or aggregation, and (3) matching of privacy obligations with each individual record in the data set. Having the capability to complete these steps was not long ago a distant aspiration. However, as we have seen in this installment, the next generation of identity-aware solutions have been tailored to do the heavy preparatory lifting for companies seeking to maximize the value of their personal data assets while remaining true to their various privacy obligations. Once an identity-aware solution has been implemented and the personal data inventories and obligations have been made to scale, it’s finally time to let the data scientists play in their sandbox to discover the next big revenue generating innovation.
photo credit: Research Data Management via photopin (license)