overcoming the practical and legal difficulties in ... › publication › vwluassets ›...

Ready for takeoff?Overcoming the practical and legal difficulties in identifying and realizing the value of data

Executive summary

B Ready for takeoff?

• Big data technologies represent a disruptive innovation that market-leading businesses will use to drive competitive advantage. Seventy-nine percent of business “decision-makers” believe that big data will boost revenue.1

• The value of big data lies in the insights that businesses can draw from it, rather than in the information itself.

• There are practical problems to overcome. In particular, there will be a battle for talent, driven by the shortage of people with the technical skills to generate insights. This requires people who can identify the right business questions that can be solved with analytics.

• While big data offers huge opportunities, there are also serious risks, including the legal and regulatory hazards relating to issues such as data privacy that can result in breach of trust. Seventy percent of consumers say that they are “never happy” for companies to share personal information while 49% say that they will be less willing to share personal information over the next five years.2

• To secure topline value from big data, enterprises need a holistic and strategic plan for identifying the opportunities, overcoming the hurdles and managing risks.

Fueling the plane

Big data is the phenomenon of our time. The combination of the astonishing explosion of data and the rapid development of new technologies capable of storing and processing this information will transform the way enterprises run their businesses. After an initial period, when big data was an optional extra for most businesses, its value is now widely accepted. Big data and analytics are starting to enter the mainstream of daily business practice.

Organizations all around the world are racing to exploit the opportunities big data presents. But they have made relatively little progress at a strategic level, in either realizing the value or managing the risks. Few companies have been able to quantify the value to be obtained from analyzing the structured and unstructured data they hold in order to generate insights on which to base decisions.

Many companies are yet to develop a comprehensive framework for analyzing what will drive that value. Projects have generally been implemented individually and separately, rather than as part of a coherent plan across the enterprise. Often, businesses do not even know what questions they should be asking.

1Ready for takeoff?

Nor have companies yet arrived at a full picture of the barriers that stand in their way as they seek to realize the value of their data. These barriers include a number of practical issues, including the volume of data with which businesses are now confronted and the skills shortages in areas such as analytics.

Legal bumps

Most of all, the legal and regulatory questions that surround businesses’ use of all types of data represent a huge barrier. Concerns such as privacy, data protection, competition law and intellectual property rights remain hugely sensitive. Laws across jurisdictions are inconsistent and constantly changing. The potential penalties for the misuse or loss of data are rising; for example, the European Parliament has voted for fines of up to 5% of a company’s global revenues for data privacy breaches. More importantly, companies that fail to consider carefully how they use customers’ digital footprints risk violating their customers’ sense of privacy and risk losing those customers.

Forty-nine percent of consumers say that they will be less willing, over the next five years, to share their personal data. This

emphasizes the fact that companies need to serve their customers better.3

Big data can make your business fly

Is it possible to overcome these difficulties in order to unlock the value of your business’s data?

The answer is yes, if enterprises are prepared to undertake an honest appraisal of their existing big data capabilities and to look at the drivers of value within their businesses, and the challenges preventing them from realizing this value. Flexibility, adaptability and integrated thinking will be crucial.

However, in such an uncertain and difficult legal environment, this process must go hand-in-hand with a rigorous examination of what regulation currently allows. Those businesses that manage this balance successfully will build customer confidence and trust. And drawing together these legal considerations will underpin a more integrated and holistic approach to big data. This requires a shift in the mind-set of board members and a transformation across the organization and closer collaborations between various functions.

Ready for takeoff

This paper addresses these issues by looking at five key industry sectors where companies’ exploitation of big data is at different stages of development. The conclusions it makes are based on the extensive work conducted by EY across its global team of industry specialists, big data and analytics consultants, and legal and regulatory experts. It also considers the evidence presented in external studies and research, as well as drawing on the best practices of the many market-leading businesses with which EY works.

Using all these insights, it sets out a blueprint for organizations determined to identify value drivers within their business, and to confront and prepare the challenges they face in exploiting such enormous potential.

With companies facing increasing suspicion about their use of personal data, it is now more important than ever for them to clearly identify and focus on the value they can generate from data; to consider carefully and respond to the regulatory, legal and practical issues they face; and to develop a coherent and company-wide big data strategy. Big data is ready to take off. Those who fail to address the technical, strategic and risk issues will be left behind.

Just as the pilot of a plane must complete a series of checks before taxiing down the runway, so business leaders must master the risks and

opportunities of big data in order to get their enterprises flying.

2 Ready for takeoff? 2 Ready for takeoff?

Big data and analytics defined

Data comes in many forms. It may be structured or unstructured, and it may be generated by organizations themselves or obtained from third parties. Big data refers to the huge and increasing volume of the data now available, as well as the variety of it and the velocity at which it can be processed.

Analytics is the means for extracting value from this data — the tool through which actionable insights are generated. Without analytics, businesses have no way of using their big data to establish competitive advantage.

Setting the context: the explosion of big data and analytics

39%The world currently has 2.7 billion internet users, 39% of the world’s population.4

96%The world currently has 6.8 billion active mobile subscriptions, equivalent to 96% of the world’s population.5

6 zettabytesThe volume of data generated or processed in 2014 will exceed 6 zettabytes, increasing to 40 zettabytes by 2020.6

Content

Fueling the plane: big data can make your business fly 5

In-flight turbulence: dealing with the legal bumps 25

On the runway or stuck in departures? A big data self-assessment guide 33

Appendix: Further reading, contacts and acknowledgments 37

3Ready for takeoff?

208,300 photosUnstructured data is booming: every minute 208,300 photos are uploaded to Facebook and 350,000 Tweets are posted on Twitter.7

49% Forty-nine percent of consumers say that they will be less willing to share personal information in the next five years.8

78% Seventy-eight percent of consumers believe that their personal information enables companies to make more money.9

59% Fifty-nine percent of business decision-makers use customer-generated data for customer insight.10

70% Seventy percent of consumers say that they are never happy for companies to share their personal data, compared with a quarter who say they are happy to share their personal data.11

79% Seventy-nine percent of businesses believe that big data will boost revenue.12

71% Seventy-one percent of executives state that they are not concerned that customers may start to restrict the use of personal information. This compares with just 19% who are worried.13

US$325 billionBetter analytics tools create huge value. The mainstream adoption of big data analytics would boost the output of global retail and manufacturing industries by $325 billion.14

20%Companies that successfully use data outperform their peers by up to 20%.15

80%Eighty percent of organizations are in the early stages of big data initiatives.16

“The first step in deriving value from big data should not be to ‘talk about’ how to get value from big data, but rather to start by asking ‘what business decisions should I make more efficiently and effectively.’ To use an explorer analogy, there is a reason why explorers who set out with a clear goal or destination in mind tended to be the ones we remember in history. Columbus didn’t set out to ‘get value out of the ocean.’ He sought an ocean route to China and ran ashore in the Americas on the way, ultimately gaining the insight that there was a large land mass between Europe and China to the west.”

Christer Johnson, Advanced Analytics Leader, Enterprise Intelligence, EY

5Ready for takeoff?

Fueling the plane: big data can make your business fly

1

6 Ready for takeoff?

Businesses are under no illusions about the size of the prize on offer to those who are able to extract maximum value from their data. EY’s research shows that companies that successfully use data are already outperforming their peers by as much as 20%.17 Furthermore, 79% of business decision-makers across sectors believe that big data will boost revenue.

Nevertheless, many organizations are frustrated with the limited progress they have made so far. While this is to be expected with the introduction of any new technology, there is an opportunity for leaders to assert themselves. They are confronted both by overarching barriers that threaten to prevent them reaching the destinations they know are possible and by sector-specific issues.

Eight barriers blocking the runway

1 The unknown destinations. Many companies understand that they possess data from which they can unlock valuable insights. But they often do not have a clear idea of what questions to ask of their data and in which areas these insights can be found. Many then fall into the trap of pursuing big data without a clear focus on how such projects can solve their business’s problems.

2 The underlying technology challenges. Big data is routinely described in terms of volume, variety, velocity and veracity and many organizations are struggling with each of these measures. They lack the means to cope with the sheer scale of data flowing into the business and with the diverse nature of structured and unstructured data. While they understand that it is an advantage to turn data into insight quickly, they are intimidated by ideas such as real-time analytics. Nor do they always know which data sources are to be valued and trusted, when to question the insights generated, or which technological tools can help them with these concerns. They have little idea of the resources they need to devote to big data projects.

7Ready for takeoff?

3 The lack of a holistic approach. Too few businesses have yet confronted the challenges of big data holistically. Instead, they are proceeding on a project-by-project basis, and with distinct silos within the business operating independently of one another and failing to share results or best practice. Some businesses are now creating specialist roles, such as chief data officers and chief analytics officers, but these remain ill-defined and less recognized at the C-suite level. Many businesses report a disconnect between their desire to capitalize on data and their ability to do so. Solving old problems in a new and efficient way seems to be a key challenge.

4 The shortage of talent. In a relatively young discipline, the shortage of skills is a serious problem for many businesses. They need data scientists, visualization experts, business intelligence analysts, data warehousing professionals and other specialists such as data privacy experts who can grasp business imperatives while delivering sophisticated analytics. But the supply of such skills remains tightly constrained. Developing these skills in-house is difficult in the short term, but buying them in externally is expensive and simply not possible in many markets.

5 The fear of cyber attack. As businesses’ dependence on data and analytics increases, so does their vulnerability to cyber attack, and so does the level of impact and damage that breaches will cause, which includes regulatory risk as well as outright business and reputation loss. Many organizations are unsure about how to build cybersecurity measures into their big data and analytics projects. One recent EY report revealed that fewer than one in two organizations (46%) have aligned their information security strategy with their business strategy.18

6 The difficulty of building the business case. While C-suite executives may accept the argument for big data initiatives in general, they want to understand the potential of specific projects before signing off on any related investments. Yet with relatively few such projects completed, it is difficult to provide such information. Executives are, therefore, asked to make a leap of faith. This is especially true for big data and analytics programs focused on generating new sources of revenue rather than cost reduction. And where businesses have gone ahead with investments, it is difficult to measure in isolation the value and efficiency versus effectiveness generated by the data-driven insights.

7 The need for legal and regulatory compliance. Many organizations understand that issues such as data privacy and security will have an enormous impact on their work in big data and analytics. But they have not yet begun to address the huge regulatory and legal risks these issues represent. If they don’t, they won’t be legally entitled to use such data for business purposes without exposing their reputation and pocketbook.

8 The need for customer data. Given the privacy issues surrounding the big data revolution, customers appear to be less willing to share data with companies. In a recent EY survey,19 70% state that they are never happy that companies share data and 49% of customers say they will be less willing to share personal information in the next five years. These numbers suggest that companies will face two serious problems if they do not start to address how they use the data they have to better serve customers. One concern is that customers will not engage with the brands or organization if they fear that their data is being misused and privacy violated. Another concern will be that the insights will not be customized to the end user.

“There is certainly a lot of hype in the market today about big data and analytics. I think people should keep in mind that we tend to overestimate things in the near term … BUT underestimate them in the long term. There is no doubt in my mind that analytics is going to transform how businesses make decisions and shift where and how value gets created in most sectors.” Christopher J. Mazzei, Global Chief Analytics Officer, EY


How, then, to begin addressing these challenges? Our extensive work with a range of different clients across a number of industries suggests that, while different organizations are at different maturity levels with big data initiatives — and the picture varies from sector to sector — there is a clear sequence for businesses to follow as they seek to drive value.

Preparing for takeoff

decide what you want to achievewith the data Too many organizations take a traditional approach to data and look at the data first — allowing it to the data to drive the decision-making process. Rather than starting with the data, companies should come up with different hypotheses based on the decisions they need to make. They should then use data and analytics to prove or disprove these hypotheses.

determine what is relevantCompanies should focus on a relatively small amount of data to identify current and anticipated problems. With a better idea of which issues they wish to tackle, businesses can start to work out how to capture the data they need. The data may already be available to the business from existing processes, or new initiatives may be required to access it. Alternatively, it may be necessary to look beyond the organization — for example, through partnerships with other enterprises. In some cases, it may take work with several partners to identify, acquire and refine the data. It will also be necessary to estimate the value to be had from using data to solve a particular problem. In addition, EU data privacy regulation provides that “personal data must be adequate, relevant, and not excessive in relation to the purpose for which it is collected or further processed.” The future data protection regulation will be even more restrictive and impose a “minimization” requirement.

generate insight from dataThis is about turning data into the type of information that a business can act on. There will be practical considerations to address, such as how to store large volumes of data and which analytics tools are required to extract the desired information. This will lead to a debate about talent: does the organization have people with the skills and experience to conduct this analysis, check the veracity of data and cleanse it from errors, typos and doublets and fill missing attributes.

An enterprise-wide approach might begin with the creation of a specialist roles, such as chief data officer and chief analytics officer. A few organizations are now beginning to understand the value of building centers of excellence that provide a single point of focus and a platform for information exchange and the sharing of insights. These centers may also resolve some of the issues around skills shortages if they are, for example, located in markets where talent is more readily available.

How to

9Ready for takeoff?

generate value from insightBusinesses need processes and systems that will disseminate the generated insights throughout the whole organization and will share results and best practice. A silo approach to data — in which business units act separately and independently — usually doesn’t deliver maximum value.

However, a data strategy driven from the center will not be successful if it does not

apply to the rest of the business in order to exploit specific opportunities. For example, local sales staff may dislike being told how to do their jobs more effectively by data scientists based thousands of miles away. Only those businesses that embed a culture that embraces data-driven decision-making throughout the organization will reap the full benefit.

manage risk The need to minimize and mitigate risk — for example, by taking a more proactive approach to issues such as data privacy and cybersecurity — will be an ongoing challenge. Risk-planning, scenario mapping and fire-drill-type exercises will build awareness throughout the business of key risks, and an emphasis should be placed on flexibility, adaptability and responsibility.

The demanding and ever-changing legal environment represents the most important risk of all.

continue driving business benefitsThe success of big data and analytics endeavors will ultimately be judged on the basis of their impact on profitability: through lower costs or — most importantly of all — through higher revenues. Organizations, therefore, need to develop ways to measure the specific impact of their data efforts. Which metrics are relevant will depend on the initiative, and might include anything from spend per customer to cost of capital. Developing such metrics can enable the business to

concentrate its efforts on areas where the greatest value is generated.

It clearly makes sense to start with the low-hanging fruit — those benefits that can most easily be obtained. An exercise to extract cost savings from finance processes may be a quick win that persuades others in the business of the overall potential of big data and of the need to begin generating ideas for such initiatives themselves.

prepare for the transformation across the organizationMeaningful operational and transformational change comes from the top. C-suite executives need to embrace this change and identify the best talent and empower other senior executives and the rest of the organization to adopt the best systems, technologies and analytics for their business. Board members have an essential role to play in ensuring that the CEO and the management team are taking the right steps to develop innovative products and that they have the right strategic approach for their company on big data. In order to extract the full value from big data, companies need all strategic functions — CEO, CFO, CIO, CMO and CSO — to work more closely. And this will require a transformational shift across the whole organization.


EY’s strategic focus • Our focus is on “value-driven analytics” by going to market

through sectors and core competencies, supported by a centralized group providing market-leading analytical and big data skills and technology.

• We realize the importance of using change management skills to help our clients use analytics more effectively to create value.

Focus of many consulting firms and technology providers • Many analytics companies in the marketplace today

are dominated by data warehousing and enterprise dashboard or reporting solutions.

• Many clients, however, still struggle to embed analytics into operational decisions in a systematic and repeatable way, often resulting in clients not realizing the full value of analytics.

Drive better decisions with analytics To drive better decisions, we must first ask the right business questions and then seek answers in the data. Thus, our work moves from left to right, but our thinking must move from right to left.

Manage

dataPerform

analytics

Improve

performance

Manage

risk

Drive

decisionsRelevant data

Appropriate data sources

Insights

Rules or algorithms

Transaction or behavior history

Continuous feedback loop

11Ready for takeoff?


Life sciences companies, including pharmaceutical and medical device businesses, are experienced data collectors with huge volumes of potentially valuable information, but these companies are still at an early stage in their efforts to generate actionable insights from this data.

One big issue to overcome is that many life sciences businesses have traditionally operated through silos, with functions such as research and development and sales and marketing operating autonomously. This has frustrated enterprise-wide data and analytics initiatives.

Nevertheless, businesses in the sector are now working hard to address this problem. AstraZeneca, for example, has set up a centralized data function that aims to build a skill set that can work across the enterprise. GlaxoSmithKline has launched a similar endeavor. The greatest impact has been achieved where analytics projects have been driven by business objectives, as opposed to a “hobbyist” approach by IT specialists.

One major opportunity now being explored by several life sciences companies could be described as “unbundling” — exploiting the potential of data to improve the targeting and effectiveness of a drug, thereby helping to improve health outcomes

“Patients increasingly demand more control over their own health data. We can expect a move toward patients owning their own data and leasing it to life sciences companies for clinical research.” Patrick Flochel, Global Pharmaceutical Sector Leader, EY

Life

sci

ence

sbusiness objectives with broader benefits


Maturity level Good data storage and collection are just beginning to generate insights.

Holistic approach Now improving, with greater use of enterprise-wide strategies.

Business benefits Early stage, but potential for gains from new revenue streams.

and reimbursement prospects. Such developments often require new ways of working. Life sciences companies such as GSK, which has traditionally been intensely protective of their intellectual property, is just beginning to talk about sharing drug trial data for the commercial benefit of their own business and for the industry as a whole.

The industry may, in any case, soon be forced to be more open, because policy-makers are increasingly determined to ensure that clinical trial data is made publicly available to support public health. Furthermore, tougher rules requiring pharmaceutical firms to track and respond to any report of an adverse drug reaction will demand more joined-up information systems. Companies that are able to to successfully implement data sharing will gain a commercial advantage in this environment and will limit their legal risks.

The potential is exciting. One project that has interested many companies is EUResist, in which data scientists use analytics tools to segment patient populations at an increasingly granular level. Such an approach has helped scientists to make huge advances in treating HIV, for which different patients need different combinations of drugs to secure the biggest improvements. By reducing the cost of overall care though better-targeted treatment, the data can change the balance of treatments, because the savings can be used to support innovative medicines that enable more specific, more predictable care.


Consumer goods companies are often at the forefront of exploiting big data opportunities in both consumer and customer-facing areas. They are increasingly looking at profit and loss performance, including pricing effectiveness, promotional effectiveness and trade spend.

Testing the results of such initiatives, where consistency of approach and visibility of performance have always been difficult, is a major focus in the sector. The results have been impressive: one leading company estimates that its most recent trade-spend initiative, which focuses on the investment consumer goods companies make with retail partners, has generated a sustainable gross profit improvement of 1%–3% of net sales. But there are clear challenges too. One is the diversity of the marketplaces in which companies operate: it is not uncommon for a particular company to have a presence in more than 150 countries.

Similarly, consumer goods companies often work with extended supply chains with multiple intermediaries. These structures may explain why the sector appears to have moved more quickly than others toward centralizing its data and analytics functions — often through the creation of multifunction business services operations. Several consumer product organizations have created centers of excellence to drive the take-up of analytics opportunities across their business. Those centers offer

Cons

umer

pro

duct

s focusing on risk and return


“Consumer product organizations are beginning to see and realize analytics as a competitive advantage and those that get to grips with that and can drive decisive decisions more quickly and more respectively would be the winners.” Richard Taylor, Global Consumer Products Advisory Sector Leader, EY

Maturity level Good in sales and marketing areas; functions such as supply chain, finance and HR are now catching up.

Holistic approach Benefiting from shift toward multifunction business services.

Business benefits Being realized in both sales and marketing, and operations.

valuable services to the rest of the business, including analytics capabilities and functionality. That is not to discount the challenge of attempting to drive enterprise data initiatives across so many markets. One issue is that, in many areas, there is a lack of data, particularly from external sources. Another key challenge is to convert the insights generated at the center into actions in each area of the business around the world.


The financial services industry has significant opportunities to capitalize on big data and analytics technologies and it has seen increased pressure to leverage this capability since the financial crisis of 2008. Regulatory stress has forced many businesses, particularly banks, to invest in areas such as risk management, compliance and operations. That has accelerated a trend, seen developing more slowly in other industries, toward enterprise data management.

While some sub-sectors have moved faster than others, the financial services sector is largely mature in terms of big data and analytics adoption across its traditional business. The focus is now increasingly on utilizing these capabilities to drive new sources of revenue. For example, insurance companies are looking to monetize the data they get through telematics devices installed in policyholders’ cars by selling it to retailers interested in the travel habits of potential customers. Credit card companies can see similar opportunities to exploit their data and augment it with additional

“Three drivers of big data adoption are simplification, cost reduction and revenue growth. An area we see revenue growth being driven is through advanced customer analytics enabling new differentiated customer experiences.” Hyong Kim, Global Financial Services Organization (FSO) Sector Leader, Enterprise Intelligence, EY

Fina

ncia

l ser

vice

semerging from the credit crisis


Maturity level Good in operations and risk; early adoption of big data into customer and growth agenda.

Holistic approach Good, but the struggle to unite disparate systems continues.

Business benefits New monetization opportunities are already being explored, legal and regulatory risks are now being mitigated.

sources to offer merchant services or help customers become more financially healthy.

Some financial services companies have redesigned their whole business model on the basis of insights gleaned from data. One South American bank has restructured its divisions around customer segments rather than types of product. Other businesses are entering the financial services arena utilizing big data and analytics to make significant advancements in the payments space.

But key issues remain. The high degree of M&A activity within the sector has left many companies with disparate IT systems that are difficult to integrate and transform across the enterprise, often requiring significant change.

Reputational risk is another important issue. Financial services companies, so battered by the crisis, are extremely cautious in areas such as data privacy and accessibility, where they fear the risk of further deterioration in client relationships, even when they comply with the letter of the law.


Trends in the power and utilities sector are leading to the emergence of vastly bigger data volumes along the whole value chain:

• In generation, the decentralization of supply required by decarbonization has created millions of small renewable assets, each generating its own data.

• Fluctuating and weather-dependent renewable energy production made it profitable to build weather forecasting data for increasingly sophisticated production schedules.

• In transmission, the focus on energy efficiency and reliability has swelled the amount of data produced by sensors and monitoring equipment.

• In retail, the trend is toward online smart meters and smart home applications, which continuously generate data.

However, the level of maturity of big data technology adoption varies among the stages of the value chain. Today, the steering of generation plant utilization as well as the energy trading activities already depend on elaborate production and market data models. Here, power and utilities profits from other sectors more advanced in big data and analytics, e.g., the financial industry.

On the other hand, the full potential of big data in infrastructure operations and retail is still to be uncovered. It is widely unquestioned that big data and analytics are the foundation for improved grid operations (e.g., through enabling demand management and “virtual storages”) and the conversion of the customer relationships. Smart meters and smart devices, in particular, are an important new source of data that

Pow

er a

nd u

tiliti

es

data explosion promises infrastructure gains


“Big data needs to be tackled on a senior executive level and should not be left to the IT department only. It should be tackled by the business as a whole.” Frank Fleischle, Partner, Power & Utilities Sector Leader, Germany, Switzerland, Austria (GSA), EY

Maturity level Slow to adopt new technologies, but potential now being seen.

Holistic approach Hampered by legacy IT issues and the structure of many companies.

Business benefits There are exciting asset and infrastructure management opportunities.

enables utilities companies to build much closer relationships with customers and to move into new markets.

Nevertheless, the development of these new smart services offerings is still in its infancy. And the question about whether there exist sustainable business cases for the majority of these new applications still has to be answered.

And there are other obvious challenges. Building enterprise-wide initiatives across the value chain is often hindered by sector regulation, keeping generation, distribution and retail at arm’s length from one another. The result is that the entities in control of the data often aren’t those that could benefit from the information that it brings — incentives aren’t aligned to make the most out of the data that is generated.

For these reasons, the sector is less mature than others in its adoption of big data and analytics tools. It is important to understand that the case for big data investment cannot be left to the IT department, but rather has to be defined from a cross-value-chain perspective that goes far beyond existing utilities offerings.


The automotive sector has made good progress on exploiting the possibilities of big data in the customer-facing areas of its business, but some of the most interesting developments are now to be found in engineering and other technical areas. For example, the use of analytics to identify problematic components is dramatically improving production quality and is generating substantial cost savings up to 80% for certain companies. The increasing sophistication of the software installed in many cars provides ever more data about engine performance, along with insights about how cars are being driven.

One key issue is the complexity of the supply chain in the industry. Much of the specialist work of design and manufacture has been outsourced to smaller suppliers. This makes for more efficient and higher quality production, but reduces the amount of data available to the manufacturer. And where suppliers are willing to share data, they may be doing so across the industry, eroding individual businesses’ competitive advantage.

Like other industries, automotive is struggling to see the big picture on big data and analytics. Return on investment is still being measured project by project, rather than

“Functionality driven and enabled by software contributes more and more to the value of a car and developing software is not within their genes.” Torsten Kiewert, Executive Director, Automotive Advisory Services, EY

Aut

omot

ivedriving more enterprise-wide benefits


Maturity level Low in customer-facing areas — functions such as supply chain and engineering are starting to catch up.

Holistic approach Difficult, given complicated supply chains, but some progress is being made.

Business benefits Experiments are taking place with new revenue streams.

across the business as a whole. One potential stumbling block to resolving this problem relates to a remuneration imbalance: those parts of the business responsible for collecting data are not generally the ones that benefit from the insights generated.

However, automotive companies are beginning to recognize the potential of an enterprise-wide approach. For example, a company is using data from its warranties operation to identify areas where mechanical weaknesses are more likely and to adjust manufacturing accordingly. This step addresses an increasingly pressing need, as China has now adopted a law — also in operation in other markets — that requires car manufacturers to offer an exchange on any car that spends more than 35 days at the garage.

Some companies are also beginning to think about monetizing their data by selling it on to third parties, or even, in the case of data on previous owners and mileage, to customers. The “connected vehicle” phenomenon will only add to such opportunities.

“The industries like pharma, insurance, and banking are still the most mature industries in terms of awareness of data privacy and compliance as they are already subject to sector-specific regulations. Now, all industries are concerned by the protection of personal data, and the million dollar question is how to use it. Ultimately, it’s a question of trust and reputation.” Peter Katko, Partner, EMEIA Head of IP/IT, EY


The difficulty of knowing what business problems they should be solving with data and analytics

The technical and technological challenges of dealing with the volume, variety and velocity of data

The lack of a holistic approach

The shortage of talent with data and analytics skills

The fear of cyber attack

The difficulty of building the business case, given the lack of awareness about potential benefits

The legal issues around personal data, privacy and copyright

Very low

Low

Moderate

High

Very high

Life sciencesConsumer products

Barriers — Maturity Barriers — Maturity

Heatmap


Financial services Power and utilities AutomotiveBarriers — Maturity Barriers — Maturity Barriers — Maturity

“Legal management of big data should be considered as a topline value enabler, not a burden.”

Bruno Perrin, Partner, Technology Media and Telecom(TMT) Market Segment Leader, France, Maghreb, Luxembourg (FraMaLux), EY


2

In-flight turbulence: dealing with the legal bumps

Protection of personal data


The legal issues confronting companies as they seek to exploit the value of their data are diverse, and vary from jurisdiction to jurisdiction. But any data strategy that fails to consider this matter will leave the business vulnerable to damage such as regulatory sanction and reputational harm. In short, it is imperative to address the legal issues around big data and analytics at the same time as the strategic issues.

When establishing big data and analytics operations, businesses will need to consider a range of legal areas, including competition law, intellectual property rights and taxation. But the issue of data protection — particularly of personal data — will sit front and center, and will be the source of a number of legal and ethical challenges.

Why personal data issues might force an emergency landing

1 The increasing significance of personal data. The protection of personal data is a central concern for consumers. This means that compliance with regulations on personal data protection is not only a way for businesses to adhere to the law but is also becoming an effective way to convey their ethical and social commitment. Good practices on data protection represent a competitive advantage for any business that makes its behavior visible to customers.

2 The need to define and manage personal data carefully. Big data and cloud computing can increase the risks raised by various key questions on how data is managed and defined. For example, what is the nature of the data the organization holds (is it sensitive, pseudonymized, anonymized, relevant for business?), where is personal data stored, how is personal data secured, do individuals still have control over their data, how can they prevent the processing of their data, and how can individuals recover their data.

3 The volume of data. The sheer scale of data collected by organizations represents a growing risk. Those businesses that do not keep track of what they hold, or keep checks on the accuracy of their information, cannot guarantee they are complying with the law. The high volume of data held also makes it increasingly difficult for organizations to anonymize personal data to meet regulatory requirements: anonymized records may still be identifiable from other information held in databases.

4 The changing legislative environment. Legislators and regulators in many marketplaces are scrambling to keep up with organizations’ efforts to exploit the value of their data.

The European Commission, for example, is moving toward implementation of a data protection regulation that will ensure common standards across all member states of the EU that will apply to any organization that operates with personal data


inside the bloc. As well as governing the way in which organizations must treat the personal data they hold, the current directive prohibits the transfer of data outside the EU without the implementation of appropriate safeguards involving, in most countries, the prior authorization of the State member’s data protection regulators. Most data protection regulators already sanction data controllers breaching data protection law. In the near future, the proposed regulation may also impose penalties of up to 5% of revenue for companies who fail to comply, raising a significant financial risk here.

5 The need to protect the company’s own data. As the threat of cyber attack grows, companies’ own data may be vulnerable, leaving them open to legal and reputational risk. And while data and

analytics sit at the heart of businesses’ digital innovation, the legal instruments available to protect and enhance data currently seem too limited given its rapidly increasing value.

6 The possibility of a big data backlash. Today’s organizations are used to operating in a golden age of free customer data. From web browsing behaviors to social media interactions with brands, all this free data can be used by companies to improve processes, decisions and customer experiences and to identify competitive differentiators.

However, consumers are becoming more and more selective and careful about who they share their data with. According to an EY survey20 customers are increasingly skeptical and many are never happy

for companies to share their personal information (70%). Moreover, 55% of consumers surveyed say that they have become less willing to share their personal data, and 48% say that over the next five years they will be less willing to share their personal data.

It is not yet clear whether this indicates that, in future, companies will have to offer an incentive for data sharing (4 in 10 consumers would be willing to share personal data if there was an incentive, but 76% of businesses have not prepared for the possibility of offering an incentive or paying customers for their personal data). But one conclusion that can be drawn from consumers’ unwillingness to share their personal data is that now is the time for companies to consider seriously how they are gathering and using big data.

The US and Europe: two different approaches to data protection

The US and Europe have radically different definitions of concepts such as “protection of privacy” and “personal data.” While the EU operates under a single regulatory regime; in the US, federal laws sit alongside the laws of each of the 50 states.

Moreover, unlike the EU, the US does not have a single body of regulation protecting privacy. Instead, legal protection is specific to particular sectors of activity, industries or other groupings. For example, the

Children’s Online Privacy Protection Act protects the personal data of children from being collected or misappropriated by commercial websites. The financial sector is covered by the Financial Services Modernization Act of 1999. There are numerous laws to protect data, but they are sector specific rather than universal.

There is also a philosophical difference. While privacy law in the US is based on consumer protection, and aims to achieve a balance between privacy and effective business, the EU sees respect of privacy as a citizen’s fundamental right,

something that is more important than any commercial interest.

One crucial difference is the emphasis placed by US legislation on the protection of data security — especially the obligation to declare breaches of security. Several US states have long-established laws obliging organizations to notify regulators of security breaches. In Europe, no such obligation currently exists, though the commission proposes to introduce something similar in its forthcoming overhaul of EU data privacy legislation.


How, then, do organizations begin to grapple with these legal risks? The response may be different depending on the organization’s geography and the nature of its business (in certain sectors, such as finance, industry-specific regulation adds to the legal burden of dealing with data). But EY teams that have worked with businesses to address legal and strategic issues simultaneously have developed key principles to address the demands that big data and analytics are now making on organizations.

The critical in-flight safety measures

confront the legal issues on a enterprise-wide basisLegal issues must be addressed by the business as a whole, rather than through silos. Businesses that do not have an enterprise-wide view risk falling foul of compliance requirements in individual territories or product categories, say, because of non-compliant behavior in other areas of the organization.

The standardization of regulation in markets such as the EU will make it easier for multinational organizations to

handle data compliance, but jurisdictional variations will continue. In any case, the need to confront the legal problems of big data on an enterprise-wide basis offers an opportunity to bring together other policies and solutions to create a single coherent strategy for the business. Many organizations are already establishing centers of excellence to exploit big data and analytics. Building best compliance practices from these centers is a natural fit.

identify legally questionable practicesWithout improved information management, an organization will have little chance of staying in control of the data it holds. Too many organizations hold outdated, unnecessary, incorrect or ambiguous data and make little attempt to cull this poor-quality information. This situation is problematic for any business seeking to drive value from data. But from a legal perspective, the lack of good information management practices presents a real danger: the enterprise may even be unwittingly holding legally questionable data.

This is a good example of where the legal and strategic responses to the challenges of big data go hand-in-hand. Data, in itself, has little value — and, in this context, excessive, low-quality data represents an unnecessary legal risk, as well as a pointless cost. Professional information practices mitigate risk and cost while ensuring that the organization can rely on the quality of its data as it seeks to leverage actionable insights from what it holds: the real value of big data and analytics.

How to


build a new structure for handling the legal issuesA new discipline requires new types of leaders to confront the challenges it presents. Roles such as chief privacy officer and chief information strategy officer will become increasingly important to organizations as they seek to implement rigor in their handling and protection

of personal data and other types of information. In order to be effective, these figures will need the sort of credibility and authority acquired by chief risk officers in recent years. The roles may even become board-level posts.

create a virtue of data privacyCommercial organizations increasingly recognize that there is value to be gained from having a reputation for good practice with data. For example, Microsoft has recently sought to establish such a reputation through advertising campaigns that have chided other businesses for their lax data protection standards. Facebook, meanwhile, has retreated from strategic initiatives that caused consternation among its users about privacy. Other businesses have begun to build consumer relationships by offering

customers something in return for their data: most loyalty schemes now operate on this principle.

Confronting the legal and regulatory challenge also presents an internal opportunity. Organizations are only as strong as their weakest link. To be secure, they need to embed a culture of data awareness at every level of the business. This fits neatly with the enterprise-wide approach that businesses need to be able to extract maximum value from their data.

consider the customer in all legaldecisions Companies should always think about what benefits they can generate for their customers and for the public in general. If companies focus their big data efforts on things that solely benefit themselves, they risk damaging the social contract that allows them access to such data.

Protection of personal data generates trust and business opportunities, and any ignorance of legal issues leads to more financial, legal and reputational risks.

Protecting the business’s dataAlthough businesses increasingly regard data as an important strategic asset, it has strictly limited legal protection.

1. Databases are defined as collections of data arranged systematically or methodically that are individually accessible by electronic or other means. Databases enjoy twofold legal protection:

• Copyright protects the structure of the database if the database can be deemed to be original in terms of its organization, its sections and their layout. Copyright is not intended to protect the information content of the database.

• The sui generis right of database producers allows for the protection of the investment made in compiling the content of the database and could, therefore, to a certain extent make up for the limited nature of copyright.

2. Protecting intellectual property may be more difficult: know-how is a concept whose definition can differ significantly from one country to another. In some territories, there is no set legal definition of the notion. Other countries allow for more extensive protection of companies’ information assets.


The pitfalls of competition lawBusinesses that are dominant in their market sectors may hold so much data that their position is deemed anticompetitive. And while the principle of data protection is to prohibit the sharing of personal data unless strict criteria have been met, competition regulators are likely to push for a more open data market in sectors where there are concerns about monopolistic practices.

Under competition law, various data collection and storage practices could be deemed anticompetitive agreements or abuses of a dominant position. If a company that holds and reserves for its own exclusive use data that is deemed vital to other operators — on the basis of intellectual property law and specific laws on databases — then it might also be accused of abuse. And as an “asset,” personal data can be taken into account in competition impact analyses of mergers.

Another related issue is data ownership, particularly in industries with highly developed supply chains. For example, in the automotive sector, several manufacturers may source technology from a single provider, creating questions about who owns — and has access to — the data generated by that provider.



3

On the runway or stuck in departures? A big data self-assessment guide

How ready are you for the big data takeoff?


Which businesses are leading the way on driving value from big data? Every industry has its leaders and laggards, but the former share one thing in common: an ability to self-evaluate in order to drive continuous improvement.

Though many organizations are very rapidly making huge progress, analytics is a technology still in its infancy. Few companies are approaching genuine maturity in their attempts to evaluate the value of the insights and to break down the barriers preventing them from realizing it.

How mature is your business’s big data and analytics capability?

To what extent has the organization set analytical objectives?

To what extent has the organization developed analytics?

To what extent does the organization possess analytics skills?

To what extent is the organization’s senior leadership supportive of analytics initiatives, or taking a lead on them?

To what extent do the organizations’ technology tools enable analytics capabilities?

To what extent has the organization embedded a culture of analytics?

To what extent has the organization considered the legal challenges of big data?

To what extent has the organization sought to mitigate other potential risks, including cybersecurity issues, related to big data?


Legal stagesStrategic stages

Stages of analytical capability21

Analytic competitors

The company uses internal and external data, statistical analysis and predictive modeling.

Analytic companies

The company has high-quality data and a company-wide analytics culture.

Analytic aspirations

The company has business intelligence tools, but there is no easy access to them.

Localized analytics

Analytics is used mostly for reporting — business as usual.

Analytically impaired

The company lacks data skills, and the data is of poor quality. Please consider whether “data skill” is the right phrase, is it “analytics skills”?

Better legal approach • There is an established committee, close to the board, that defines and manages data strategy.

• The legal department has implemented a systematic consultation process to handle legal issues related to data management.

• The chief privacy officer reports to management, organizes training and is certified by third-party organizations, such as IAPP or euroPrise.

• Best practices regarding data protection compliance such as Binding Corporate Rules or European Seals are being considered.

• The databases developed by the company are protected as a strategic asset, with the use of copyrights and other relevant IP.

Good legal approach • Strategic thinking is in progress on how data can be integrated in the business strategy.

• Establishment of governance across various businesses.

• Legal officers are involved if the case-by-case project requires data management, but this doesn’t apply as such as policy in the organization.

• There is a reasonable level of awareness of data privacy topics.

• A chief data privacy officer has been appointed to deal with data privacy issues.

• Some data protection compliance procedures have been developed.


Developing legal approach • Collection and data management are recognized as being part of the organization’s challenges.

• There is some awareness of data privacy topics and an in-house contact to deal with data privacy-related questions.

• The chief privacy officer reports to management, organizes training and is certified by third-party organizations, such as IAPP or euroPrise.

• Best practices regarding data protection compliance such as Binding Corporate Rules or European Seals are being considered.


Poor legal approach • There is neither chief data privacy officer nor a consistent data privacy compliance management team.

• Compliance is monitored on the basis of an informal connection between the in-house lawyers and CRM or marketing teams on a case-by-case basis,

• There is only a limited data strategy and there are few internal tools.

• Collection, management and valuation of data are not identified as crucial to competitive advantage for the organization.

• Data is solely organized and managed by the financial function.

Best legal approach • Best practices for the management of legal issues around data processing are implemented and receive regular review (audit and control regarding the management of data and IT security to check compliance both with data protection rules and with in-house data protection and IP procedures).

• Binding Corporate Rules have been deployed within the group.

• There is a designated data privacy officer who is well connected with the data analysis teams.

• Third-party certification of trust is part of business. • The establishment of a maturity model optimizes the dissemination and management of these best practices.

6

8

7To what extent has the organization embedded a culture of analytics?

1pt It does not figure.

2pts Awareness of data and analytics is growing, and demand is beginning to increase.

3pts Business leaders have begun to drive data awareness throughout the organization, and penetration rates are starting to rise.

4pts Business leaders have persuaded staff throughout the business to recognize the value of data-driven decision making.

5pts The whole organization is geared toward identifying data from which actionable insights can be drawn, and acting on those opportunities.

To what extent has the organization sought to mitigate other potential risks related to big data and analytics, such as cybersecurity issues?

1pt We have yet to think about these issues.

2pts We have begun to focus on big data opportunities, but are not yet planning and preparing for the associated risks.

3pts There is growing awareness that, as our enterprise embraces big data and analytics, risk is a crucial challenge to be confronted.

4pts The business runs scenario planning exercises and other drills in order to address specific risks.

5pts The question of risk is embedded throughout our big data and analytics processes.

To what extent has the organization considered the legal challenges of big data or analytics?

1pt This is not on the agenda.

2pts Awareness is very limited and no single figure or function is addressing these questions.

3pts The business has begun to consider legal issues as part of an integrated approach.

4pts The business considers legal issues at a high level and has processes in place to ensure enterprise-wide compliance.

5pts Consideration of legal risk is fully embedded in an enterprise-wide big data and analytics strategy. Compliance is promoted and is effectively a business enabler for the business.

Your big data score

Your enterprise is only beginning to consider the potential for exploiting big data and analytics technologies. Where projects are being considered, there is little attempt to coordinate activity, and business leaders are failing to take the initiative. Your organization may also be vulnerable to legal risk and cyber attacks.

8–18 points

Your enterprise has made some encouraging steps toward realizing value from big data, but there is a great deal more work to be done. There is some leadership from the top of the company, and functions are beginning to work together, but a culture of data awareness has not yet been embedded throughout the organization. Risk mitigation needs to be a priority.

19–29 points

Your enterprise has made good progress with big data and analytics projects, and it has a holistic strategy that emphasizes enterprise-wide solutions. Staff members at every level of the company are data-aware, with C-suite executives leading the charge toward driving value. The emphasis now will be on performance measurement and on ensuring that data generates a continuous cycle of business benefits.

30–40 points

This exercise is indicative only and should not be considered a granular assessment of your enterprise’s readiness for big data takeoff, or its legal preparedness. Individual corporate priorities will vary from business to business.

Note

1

2

3

5

4

To what extent has the organization set analytics?

1pt It has limited insights into customers, markets and competitors.

2pts Some business functions have begun experimenting autonomously.

3pts The organization has begun to set enterprise-wide strategies and consider performance metrics.

4pts A change management program is in place to develop analytics capabilities throughout the business.

5pts The organization is already generating deep strategic insights and is continually innovating to boost data-driven decision making.

To what extent has the organization developed analytics?

1pt None are in place.

2pts Business functions operate independently of one another.

3pts The organization is beginning to establish enterprise-wide processes.

4pts Many enterprise-wide processes are in place.

5pts Enterprise-wide processes are fully embedded in the organization.

To what extent does the organization possess analytics skills?

1pt The skills are missing or have yet to be identified.

2pts A handful of analysts work in particular business functions.

3pts Business functions have begun to recruit greater numbers of analysts.

4pts The organization has made recruitment a priority at an enterprise-wide level and has many skilled analysts in place.

5pts Skills shortages are not a problem and analysts are working in integrated teams throughout the business.

To what extent do the organization’s technology tools enable the development of analytics capabilities?

1pt Systems are not integrated and data is in short supply or unreliable.

2pts Data is missing and systems are poorly integrated.

3pts Data warehouse initiatives are under way and some analytics tools are available.

4pts Data is of high quality and enterprise-wide solutions have been developed.

5pts The business has implemented an enterprise-wide architecture that is already generating good results.

For each of the following eight questions, select one of the answer options to evaluate your company’s current level of maturity.The scale goes from 1 = not at all to 5 = completely. Calculate your total points and see your total on the flipside.

How mature is your business’s big data and analytics capability?

To what extent is the organization’s senior leadership supportive of analytics initiatives, or taking a lead on them?

1pt Initiatives are localized or nonexistent.

2pts Initiatives are led by business functions.

3pts Executives are starting to understand competitive opportunities.

4pts Initiatives have C-suite support.

5pts Initiatives have CEO support and C-suite leadership.


Appendix: further reading, contacts and acknowledgments

4


Additional EY thought leadership resourcesEY regularly publishes insights on digitalization, transformation, governance, risk and compliance, including thought leadership on information security topics. These perspectives are designed to help clients by offering timely and valuable insights that address issues of importance for C-suite executives.

Born to be digital: how leading CIOs are preparing for a digital transformation, EY, 2014 ey.com/CIO

Cultural behavior and personal data at the heart of the Big data industry: finding the right balance between privacy and innovationey.com/FR/fr/Industries/Media---Entertainment/Comportements-culturels-et-donnees-personnelles-au-coeur-du-Big-data

Under cyber attack: EY’s Global Information Security Survey 2013 ey/com/giss

Privacy trends: the uphill climb continues ey.com/bcmtrends

The Big Data Backlash, EY, 2013


Contacts

AuthorsDrazen NikolicPartner, EMEIA Enterprise Intelligence Leader, EYPhone: + 49 89 14331 19481Email: [email protected]

Christopher MoorePartner, EMEIA Advisory Services, EYPhone: + 44 207 980 9250 Email: [email protected]

Fabrice NaftalskiPartner, Attorney at law, EMEIA Head of IP/IT Law, EY Phone: + 33 1 55 61 10 05Email: [email protected]

AcknowledgmentsWe would like to thank EY’s experts across sectors and global workstreams on big data for giving valuable insights to this point of view. Finally, we would like to thank Longitude for helping us writing this piece.

Christopher J. Mazzei Global Chief Analytics Officer, EY

Christer A. JohnsonAdvanced Analytics Leader, Enterprise Intelligence, EY

Bruno PerrinPartner, TMT Market Segment Leader FraMaLux, EY

Patrick FlochelGlobal Pharmaceutical Sector Leader, EY

Iain ScottSenior Analyst, Global Life Sciences Center, EY

Dr. Frank FleischlePartner, Power & Utilities Sector Leader, GSA, EY

Torsten KiewertExecutive Director, Automotive Advisory Services, EY

Hyong Y. KimGlobal FSO Sector Leader, Enterprise Intelligence, EY

Kevin KoenigPartner, FSO Advisory Services, EY

D’Artagnan CatellierSenior Manager, FSO Advisory Services, EY

Errol GardnerPartner, EMEIA FSO Advisory Services, EY

Richard TaylorPartner, Global Consumer Products Advisory Sector Leader, EY

Elaine ParrAdvisory Market Development Leader, Global Consumer Products Sector, EY

Patrick JamesPartner, Advisory Services Customer Leader, UKI, EY

Vincent PlacerExecutive Director, Advisory Services, EY

Peter Katko, Partner, EMEIA Head of IP/IT Law, EY


1 Big Data Backlash, EY, 2013.



4 World Telecommunication/ICT Indicators database 2013, ITU, December 2013.

5 World Telecommunication/ICT Indicators, ITU, 2013.

6 The Digital Universe in 2020: Big Data, Bigger Digital Shadows, and Biggest Growth in the Far East, IDC, December 2012.







13 Extracting Insights from Exabytes, GP Bullhound, November 2013.

14 Game changers: Five opportunities for US growth and renewal, McKinsey & Co, July 2013.

15 Big data and enterprise mobility, EY, 2013.



18 Under cyber attack — EY’s Global Information Security Survey 2013, EY, October 2013.



20 EY’s data maturity model builds on the work of American academic Thomas Davenport, whose work provides a framework for organizations seeking to create better analytics capabilities. Davenport’s strategy for successful analytics is based on the DELTA model: Data — the nature, quality and uniqueness of the data the business has, as well as the way in which it is integrated, accessed and protected. Enterprise — the extent to which the business takes a holistic view of the data it has and how to exploit it. Leadership — the commitment and passion for analytical competiveness and capability. Targets — the extent to which the organization marshals its resources — particularly its skills — in order to focus on the highest-value applications of analytics. Analysts — the extent to which the organization has hired skilled data scientists who can convert data into actionable insight.

Notes


About EY

EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

© 2014 EYGM Limited. All Rights Reserved.

EYG no. AU2216

EMEIA Marketing Agency 1000828

ED None

In line with EY’s commitment to minimize its impact on the environment, this document has been printed on paper with a high recycled content.

This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax or other professional advice. Please refer to your advisors for specific advice.

The views of third parties set out in this publication are not necessarily the views of the global EY organization or its member firms. Moreover, they should be seen in the context of the time they were made.

ey.com

EY | Assurance | Tax | Transactions | Advisory

overcoming the practical and legal difficulties in ... › publication › vwluassets ›...

Documents