Brian O’Donnell and Richard Nesbitt, Global Risk Institute in Financial Services
The world needs “personal data advocacy,” where an institution works with people to gather, protect and monetize their personal data. We think a comprehensive collection of personal data will enable everyone to exercise some degree of ownership control over it because now they have little control.
Last April, Senator Jon Tester of Montana challenged Facebook chief executive Mark Zuckerberg’s claim that clients owned the data they provided to the company.
“You said multiple times during this hearing that I own [my] data,” Mr. Tester said in a U.S. congressional committee hearing. “That sounds good, but in practice you’re making $40-billion a year. I’m not making money on it. It feels like you own the data. Could you give me some idea on how you can honestly say it’s my data?”
Social-media companies have amassed more than $2-trillion dollars in market capitalization. Their mass collection, storage and monetization of data have increased consumer exposure to cybersecurity issues and financial fraud. Facebook, Equifax and others have proven that.
Worse still, social-media firms take all the upside and leave users with all the risk, and then banks generally absorb the losses when accounts are hacked.
The current model has cracks in it so it’s time for another approach.
What is personal data advocacy?
With ownership of their data, individuals could then decide how they want their data used. For example, do they want to lock it down, sell it or donate it to a charity or research organization?
There are many possibilities. Once an individual gathers relevant data in one secure place, the data can be used to create a penultimate cyber profile; a profile based on spending data, search data, social-media data, etc. from online and offline sources.
Such a profile will be a better cyber representation than any profile being created today because it will be a complete data set and can be directly verified by the client or their agent. Not only will those data be valuable, should clients choose to monetize them, they can also enable more advanced cybersecurity practices and enhance personal identification theft insurance.
The individual is much better off because they have a trusted firm providing this type of personal data advocacy for them.
The components of each individual’s personal data can be put into three categories.
The first and most valuable is offline private data. This includes static personal data (name, birth date, address etc.) and financial data (chequing accounts, loans, investing, etc.). Financial institutions protect this transaction data already, so they are a natural candidate to offer personal data advocacy.
The second category is online private data (everything from Google searches to device clicks and websites/apps visited).
The third component of personal data is online public data, primarily social-media profiles and certain public government records.
Search engines and social-media companies gather data and sell it to advertisers. The data is based only on narrow slices of one’s full data profile so it is incomplete and the value not optimized. Even when data brokers aggregate data from various providers, they are often estimating matches. Personal data advocacy gives you the fullest bang for your buck.
Role of financial institutions
We think financial institutions (FIs) in general, and banks in particular, are well suited to help bring this type of service to clients.
FIs are already custodians of our most valuable and sensitive transaction data. It would be natural for them to develop applications (likely via a partnership with a technology or telecommunications company) that could combine this information with other online data, and then store a complete data set in one “lock box” or data vault for each customer. Clients would suddenly have the most complete and valuable collection of their own data. Even if those data were compromised, it would be much easier to reset and lock them from one source than chase down every other owner of your data.
Such data could then be sold, if the client chose, or could be analyzed for valuable insights (e.g. purchases, discounts and personal security insights), or could simply be locked down. Additionally, the personal data service provider could then help anonymize the client online, significantly reducing personal cyber risks.
It has been said that data is the new oil, and if that is the case, people could be sitting on a significant unclaimed reservoir. As for the search and social-media companies who would lose access to free money, they would have to adjust their business model just as the media have had do since Google and Facebook arrived on the scene.
Personal data advocacy gives people claim to the rightful ownership of data assets that could enable them to both harvest value and enhance their cybersecurity. We believe the time is right for financial institutions to take the lead and manage this newest form of financial asset.