You don’t need to tell me

In May 2018 the European Union’s General Data Protection Regulations (GDPR) will come into force, replacing the existing Directive 95/46/EC, which will be repealed.  The new regulations are seen as an enabling requirement of the European Digital Single Market – removing the current fragmentation of how the existing directive is implemented by member states, and providing legal certainty in particular regard to online activity.  

GDPR gives EU citizens significant protection, by placing obligations and responsibilities on data controllers and processors, that are legally enforceable.  These regulations don’t just apply to data controllers or processors based in the EU – most larger organisations, globally, who offer goods or services - regardless of whether they charge for them - to EU data subjects will be in scope of the regulations.  Many of these organisations will have to appoint a representative who is subject to enforcement procedures in the event of non-compliance.

Over the last few years “Big Data” has been a buzz word in the boardroom, encouraging the collection and analysis of personal data to become core to many company strategies.  Often, customer consent has been obtained in a far from transparent way; GDPR seeks to address this by introducing obligations that consent should be freely given, specific, informed and an unambiguous indication of the data subject’s agreement.  It also provides protection that personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.

With fines of up to the higher amount of €20m or 4% of a company’s worldwide annual turnover, GDPR is a regulation with teeth.  A corporate risk register without compliance to the GDPR on it would be incomplete.  And for any organisation that approaches consent by including a line in their terms and conditions, or pre-ticking the consent box, it would be a folly to believe that they have obtained unambiguous agreement.  Harvesting data because “it could be useful, or “we might need it in future”, or “we might be able to gain some great insights”, isn’t going to cut it.  If you imagine the number of people organisations currently send marketing emails to, because they forgot to untick the box; now compare that to how many people in future would actively chose to  be sent weekly offers, you can start to see the scale of impact that GDPR will have.

A post GDPR company, unless they’re a data services company, should wherever possible adopt a data minimisation approach.  If data isn’t their thing – then companies should stop gathering it wherever they can.  They should take a critical look at every data field they capture and ensure that they can objectively justify it.  If the reasons as to why a data item is necessary aren’t clearly justified, then companies should stop capturing it and make plans to remove existing data from their processing systems.  They should also look at whether they need the data itself or just the outcome – for example do they need to know someone’s date of birth or just that they meet certain age criteria?

With data minimisation becoming more prevalent, opportunities for companies to provide data services to others become much more valuable proposition; though adequate trust frameworks need to exist.  There are two approaches to providing these services.  Companies such as Mydex and Digidentity provide a great model of privacy by design, where only the data subject themselves has access to their data in unencrypted form.  These companies hold data on behalf of the individual and develop services to allow them to utilise it as a means of monetisation – either paid for by the user or the organisations that they choose to interact with.  Consent in this model becomes absolute, as the company themselves don’t define processing or sharing of the data – the power is entirely in the hands of the data subject.  There are also opportunities for blockchain solutions that orchestrate connections to storage in database sharding architectures.

The other approach is for companies to become banks for user data.  In this model the individual is still in control of their data, though the data service company is able to monetise the user’s data by aggregating it – much like a traditional bank aggregates the deposits of its customers to invest or lend to other customers.  The development of services useful to the data subject being the catalyst for them to deposit more data – more money, more interest becomes more data, more services.

GDPR undoubtedly puts the data subject in greater control of their own data, with consent being the core principal.  There are also new and strengthened rights for the data subject with the obligation to act upon these rights falling on the data controller or processor.  Whilst certain derogations are made for micro, small and medium enterprises, the fundamental regulations apply universally.  There are some great summaries of the regulations which every organisation should take the time to read and understand.  Unless you’re going to invest the time to read and understand the regulation and impact assess your organisation against it – when it comes to being the controller or processor of personal data, my approach would be to say to your customer “you don’t need to tell me”.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk 
I didn't say you could touch me - Biometric authentication and identity
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour -  The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business 
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture.  Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

Coming together on being alone

In case you missed the news - the UK will exit the European Union in the coming years with the aim of gaining sovereign control of the nations future without the interference from the other 27 member states.  Whatever your views on the rights or wrongs of this decision - the outlook for the future and the UK’s role on the world stage - one global influence on the UK that is unlikely to alter will be the digital / cyber sphere.  Whilst undoubtedly governments can and do moderate the online world’s influence on their citizens, national borders on the world wide web are far harder to control than in the physical world.

A recent celebrity super injunction was challenged in the UK courts on the basis that the information it sought to protect was freely available and easily accessible on the internet for sites hosted and governed by other jurisdictions.  When it comes to cyber security, digital identity and online regulation, the larger the physical jurisdiction, the more global influence exists in how the online world operates.

At a recent digital / cyber / identity / security event that I attended, a relatively senior UK civil servant was presenting on behalf of their department’s view of upcoming EU cyber legislation; during the presentation they referenced a meeting earlier that day with the newly appointed cabinet minister for their department on what the opportunities post-Brexit were for the UK in cyber industries.  When asked for the outcomes from this topic the response was “I don’t think its appropriate for me to comment on that here”.  This was a room full of subject matter exerts from academic, industry and public sector looking for guidance and insight from the UK government - what more appropriate time could there have been to discuss this?

The UK currently plays a leading role in global cyber policy - providing thought leadership, global policy and development of international standards on a range of topics.  We simply cannot afford to lose our voice and influence if we’re to achieve the sovereign control that the decision to leave that EU was intended to deliver.  That means having strong leadership that gives a clear roadmap on the UK strategy for how we will adopt and interoperate with globally agreed objectives.  We simply cannot afford to be inward looking when it comes to the digital world.

The EU has a strategy for the Digital Single Market - so not only will we be negotiating our position in the physical Single Market, we’ll also be negotiating our relationship in the digital one too.  One of the key component of this Digital Single Market will be the electronic identification and trust services for electronic transactions in the internal market regulations (otherwise known as eIDAS).  The eIDAS regulations aim to enable secure and seamless electronic interactions between businesses, citizens and public authorities with electronic ID (eID) and electronic trust services (eTS).  Having a common framework for interoperability that permits cross border transactions is a key building block of the Digital Single Market.  The member states transacting in this market have standards based implementation of identity schemes, electronic signatures & seals, delivery services and website authentication.  All these electronic trust services will have legal validity within the member states. 

In eID, the UK Government have their interoperable eIDAS aligned service GOV.UK Verify - so on the face of it we’ll be able to access the Digital Single Market at least from this perspective; except that along with “the new way to prove who you are online” the GOV.UK platform is still promoting registration to the old way - Government Gateway; even for the services listed under the new way, the old way is still prevalent and often more prominent.  So our inward looking approach is already being promoted above the needs of the outward EU interoperable standard.

The answer to what are the opportunities for UK cyber industry post-Brexit are reliant on an updated Government Digital Strategy; we need to know whether we’re going to be more Estonia than North Korea as a nation when we have reclaimed our sovereignty.  We need bold leadership that outlines what our ambition is on the global stage; industry needs to know that digital UK has a return available on their investment; academia need to know the skills that future generations will need and they need to know that funding sources aren’t going to be strangled by our unwillingness to operate with a global outlook.  

If government can’t control its own departments under a single digital strategy whilst we’re faced with EU regulation being imposed, then what message does this send for our post-Brexit future?  We simply cannot afford to go it alone in the digital sphere - our opportunity to provide the thought leadership and influence of innovation, security, regulation and standardisation needs to be increased, not diminished.  

The UK Government is embarking in it’s biggest transformation programme ever - my earlier post on why transformation programmes fail, Rip it up and start again, highlights the importance of a clear strategy and vision.  In the digital sector we need to know how we plan to come together, otherwise we risk being very alone.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk 
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour -  The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business 
One Small Step - The practice of greatness
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture.  Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan

One Small Step

The practice of greatness

The Nasa Juno mission arrived safely into its orbit around Jupiter.  Nearly five years of travel and over eleven years of planning went into that moment.  The culmination of hard work, dedication and brilliance of the Nasa team working towards a single goal: To understand the origin and evolution of Jupiter.  Upon receiving the signal from the Juno Spacecraft that its arrival was successful the team rightly celebrated – more memorable quotes entered into space exploration folklore.

"Nasa did it again.  That says it all to me. And I'm so happy to be part of the team that did that. I mean this team has worked so hard and we have such great people. And it's almost like a dream coming true right here.  The mission team did great. The spacecraft did great. We are looking great. It’s a great day." - Scott Bolton, Juno's principal investigator.

Now for most teams, the goal won’t be quite so grand; the impact not quite as significant.  Though should the celebration of success be any less important?  Every day when we go to work, we should know what goal we’re working towards – what difference we’re going to make and our how we’re progressing against our target.

Whether your team is working towards a weekly sales target, is managing against key performance indicators or service levels, or is delivering against time, cost and quality metrics, the importance of ensuring that everyone understands the goal and the role they play in achieving it shouldn’t be underestimated.  If you’re leading that team you have the responsibility for making it great.

“We did it again” – a great team delivers time after time.  Nasa didn’t send Juno off and check back on its progress after 5 years.  Every step of the way, every action, every moment was carefully managed by the team – with corrective action being taken whenever required to ensure that the trajectory towards success was maintained.

“I’m so happy to be part of the team” – a great team is a happy team.  We all have off days, stressful times, personal problems, work issues.  If you or any of your team are unhappy you need to address it and work out a solution.  Make sure that your team has the things in their hierarchy of needs to stay happy.

“This team has worked so hard” – hard work needs to be rewarded.  Appreciation isn’t just about monetary remuneration – a thank you; a lunch time meal; a trip to the park; a drink after work – reward your team and they’ll reward you.

“We have such great people” – building a great team is much easier if you resource it with great people.  Take the time to unlock their potential; recognise their strengths and support them with their weaknesses.

“It's almost like a dream coming true right here” – to make your goal a reality you need to know what success looks like.  Make sure everyone knows what is expected from them and let them know how they’re doing against those expectations – do it regularly and often.

“The mission team did great. The spacecraft did great. We are looking great. It’s a great day." – Reaching your goal should be celebrated as a great day.  Your great team got you there.  Make sure that they look great to themselves and to others.  Celebrate your success together and be proud to shout about your achievements.

Your team might not be going boldly where no team has gone before, they might not be changing the world.  Though remember, the practice of greatness involves just one small step at a time.

Read my other posts

Just in Case - From early adoption to maturity
I have control - Can we truly own our identity
Tipping the balance - Getting the right balance between security and user experience
You don't know what you're doing - Poor security practices are putting users at risk 
I didn't say you could touch me - Biometric authentication and identity
You don't need to tell me - Impacts of the EU General Data Protection Regulations
Coming together on being alone - The need for a clear government digital strategy
I'm not the person I used to be - Authentication for real world identities
Distributed Identity has no clothes - Will distributed ledger technology solve identity
Bring Your Own Downfall - Why we should embrace federated identity
Unblocking Digital Identity - Identity on the Blockchain as the next big thing
Tick to Agree - Doing the right thing with customer's data
The Kids Are All Right - Convenient authentication: the minimum standard for the younger generation
The ridiculous mouse - Why identity assurance must be a rewarding experience for users
Big Brother's Protection - How Big Brother can protect our privacy
I don't know who I am anymore - How to prove your identity online
Three Little Words - What it means for your business to be agile

Defining the Business Analyst - Better job descriptions for Business Analysis
Unexpected Customer Behaviour -  The role of self-service in your customer service strategy
Rip it up and start again - The successful Business Transformation
Too Big To Fail - Keeping the heart of your business alive
The upstarts at the startups - How startups are changing big business 
In pursuit of mediocrity - Why performance management systems drive mediocrity

About me
Bryn Robinson-Morgan is an independent Business Consultant with interests in Identity Assurance, Agile Organisational Design and Customer Centric Architecture.  Bryn has near 20 years experience working with some of the United Kingdom's leading brands and largest organisations.

Follow Bryn on Twitter: @No1_BA

Connect with Bryn on Linked In: Bryn Robinson-Morgan