Connect with us

Technology

What can we expect from data protection in the year ahead?

Camilla Winlo, Head of Data Privacy at Gemserv

The past year has been a turbulent one for cybersecurity, with a number of high profile breaches hitting the headlines. The pandemic has of course played a central role in conversations around data privacy, while entire industries have been accused of data handling malpractice. So, what are the stories we can expect to see shaping the agenda in 2022?

Here are four developments we expect to see in the year ahead:

  • Polarisation around Covid vaccination data will increase

While there are early indications that the combination of vaccination, immunity from previous infection and the evolution of the virus may cause less significant symptoms in most, it still appears that Covid is capable of making unvaccinated and immunocompromised individuals very ill. In winter, this puts huge pressure on the NHS and the public purse, and we expect this to translate over time into increased pressure to encourage the unvaccinated to get vaccinated, and for society to impose different rules on the unvaccinated. We started to see this in 2021 and expect it to continue into 2022.

With different quarantine rules for vaccinated and unvaccinated employees and the possibility of compulsory vaccination on the horizon, more and more organisations are going to find themselves processing Covid vaccination data. Quarantine measures are set to continue to help stop the spread of the virus, which in turn, will mean that organisations will still need to incorporate a hybrid approach to work. Some employees will test positive for Covid and therefore will not be allowed to leave their homes, but they won’t have symptoms that would otherwise stop them from working. Others may have come into close contact with a positive case and will also need to isolate. All of this will have an impact on employers.

Going into 2022, we expect tensions between pro and anti-vaxxers to rise. This is unlikely to be mitigated much by the amount of real-world vaccine safety data that is available, which is what a lot of vax-hesitant people say they are waiting for, due to the polarisation of information availability and the fact that in some cases, vax hesitancy will be rooted in genuine and founded concerns, for example where individuals have health conditions that make taking the vaccine a more personally risky choice. That makes Covid status an employee safeguarding issue due to the risk of discrimination between employees. There will also be companies that want – or are compelled – to terminate unvaxxed employees, as well as some that will do the reverse.  We can expect to see these decisions appealed as the ‘grey area’ around what counts as a medical exemption is clarified.

  • Tighter regulations around ad tech

The European Data Protection Board (EDPB) published its 2021-2023 strategy in December, and part of that strategy includes more proactive monitoring of ad tech. Ad tech is under huge pressure to tighten up its data protection practices after the Irish Council for Civil Liberties sued a branch of the Interactive Advertising Bureau (IAB) and others over what it described as “the world’s largest data breach” in 2021.

IAB found itself under fire for its role facilitating a process known as real-time bidding, where personal data is passed between hundreds of ad brokers and related firms during an auction process in the moments before a website loads, on behalf of paying brands. During the milliseconds between clicking on a page and it loading, everything from the type of device an individual is using to limited location data and browsing history can be shared with brokers to better target that person.

The breach spurred numerous complaints from the likes of none of your business (noyb), the European centre for digital rights, and various court cases after finding that the ad tech industry is fundamentally unlawful because of the way it is structured. Better regulation around ad tech needs to be put into place not just for the advertisers themselves, but for online retailers, too. It’s going to be incredibly important for the economy as a whole that the ad tech industry gets this right, but there is a lot of work to do to get there.

  • Regulatory action around Artificial Intelligence (AI) will ramp up

While the European Data Protection Board (EDPB) strategy highlights the need for more proactive monitoring of AI use, the UK National Data Strategy focuses on making sure AI works and that the UK is a leader. Data privacy must be a priority or the result will be poor quality solutions that don’t work as intended. AI-specific regulations are set to be enforced and I think we’ll see some interesting actions.

After facial recognition company Clearview AI was issued a Notice of Intent to fine following a number of breaches of national data protection law, conversations around the practices of ethical data collection and analysis have come to the forefront of public attention. It’s essential that organisations that want to harness the possibilities of AI and data-driven innovation in the UK do so in a way that protects individuals.

Organisations should be entitled to trust that providers like Clearview AI are engaging in ethical practices and that their services can be used lawfully. It’s very reassuring to see the regulator taking strong action to make AI innovators trustworthy. Whether it’s fighting crime, preventing fraud or other forms of safeguarding through data, when the public and private sector combine, they must ensure the right processes are put in place in order to comply with data protection regulation.

  • Privacy Shield 2: A new basis for sharing data between the EU and the US

The Privacy Shield framework was the second attempt by the EU and the US to create a secure mechanism for data sharing. It was thrown out in court after judges deemed the framework insufficient to provide adequate safeguards for the transfer of personal data from the EU to the US, and they’ve been working ever since to replace it.

The exchange is a one-way deal – there are cultural differences between the EU and the US that mean that personal data in the EU is protected in different ways to personal data in the US. The purpose of Privacy Shield is to provide a way to allow EU data to be processed by US companies without losing those protections. I expect we will see some major announcements coming next year, which will include technological changes by Big Tech household names, and that in turn will lead to work for UK and EU businesses.

Regulations are indispensable to the proper functioning of economies and societies, and to protect those structures, we need to implement the right data protection measures. Having the right data protection regulations in place is critical to ensuring the proper functioning of organisations, and for ensuring that both customer and employee data is handled correctly. As businesses and governments continue to generate more data than ever, we need to take regulatory action to create secure, ethical data storage and sharing practices.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Business

Why email marketing remains one of the best forms of digital marketing

Crafting a strong email marketing strategy involves a real balance between creativity and making data-driven decisions, which, is just one of the roles undertaken by marketing and data company Go Live Data on behalf of its many clients.

Guiding some of the biggest corporates in the UK including Amazon Business, AxA and Premierline Business Insurance, Adam Herbert, CEO of Go Live Data, advises on the key components to a successful email campaign and why as one of the most effective marketing tools available, email still plays a crucial role in digital marketing:

Forming a direct means of communication, emails provides a and two-way access between businesses and their customers. And it may sound obvious to say, but unlike social media or other digital channels, every email allows marketers to reach their audience straight into their inbox, and this is where individuals are most likely to engage with the content they’re being shown.

Offering a high return on investment,  emails consistently deliver one of the highest ROI’s compared to other forms of digital marketing such as PPC and advertising. According to studies, the average is around £40 for every £1 spent, which is huge; and due to the low cost of email, its ability to drive conversions and to retain customers.

What’s more, with email segmentation and many personalisation techniques available, marketers can tailor their messages to specific groups of their audience, based on demographics, their behaviours, interests, and purchase history making them not only very targeted, but personalised too. The key is to deliver relevant content to subscribers, which means marketers can increase engagement, conversions, as well as customer satisfaction.

There are specific platforms which allow for automation, giving marketers the ability to set up automated workflows triggered by user actions and also means that marketers can deliver timely and relevant messages at scale, by nurturing leads, as an effective way to guide customers efficiently through the sales funnel.

Emails are also an excellent way to build customer relationships, by nurturing over time. By consistently delivering valuable content, exclusive offers, and personalised recommendations, businesses can strengthen the ‘bond’ with their audiences and increase brand loyalty. Email provides a means of two-way communication, which allows customers to send in their feedback, to ask any questions they may have and to  engage with a brand directly.

They are also a great way to drive traffic to your website, blog and social media, or any other digital channels connected to your business. By including attractive or compelling calls-to-action (CTAs) and relevant content, you can encourage subscribers to take action such as making a purchase, signing up for a webinar, or downloading a resource, which in turn will drive conversions and revenue for your business.

Email platforms offer substantial analytics and reporting functions that enable marketers to track the performance of their campaigns in real-time. Monitoring of key metrics such as open rates, click-through rates, conversion rates, and revenue generated, allows marketers to measure the effectiveness of their campaigns and of course make data-driven decisions to optimise and plan future activities.

Overall, emails are an integral component of a digital marketing and by leveraging email effectively, businesses can engage their audience, nurture leads, drive sales, and ultimately grow their businesses.

Continue Reading

Business

Conflicting with compliance: How the finance sector is struggling to implement GenAI

By James Sherlow, Systems Engineering Director, EMEA, for Cequence Security

GenerativeAI has multiple applications in the finance sector from product development to customer relations to marketing and sales. In fact, McKinsey estimates that GenAI has the potential to improve operating profits in the finance sector by between 9-15% and in the banking sector, productivity gains could be between 3-5% of annual revenues. It suggests AI tools could be used to boost customer liaison with AI integrated through APIs to give real-time recommendations either autonomously or via CSRs, to inform decision making and expedite day-to-day tasks for employees, and to decrease risk by monitoring for fraud or elevated instances of risk.

However, McKinsey also warns of inhibitors to adoption in the sector. These include the level of regulation applicable to different processes, which is fairly low with respect to customer relations but high for credit risk scoring, for example, and the data used, some of is in the public domain but some of which comprises personally identifiable information (PII) which is highly sensitive. If these issues can be overcome, the analyst estimates GenAI could more than double the application of expertise to decision making, planning and creative tasks from 25% without to 56%.

Hamstrung by regulations

Clearly the business use cases are there but unlike other sectors, finance is currently being hamstrung by regulations that have yet to catch up with the AI revolution. Unlike in the EU which approved the AI Act in March, the UK has no plans to regulate the technology. Instead, it intends to promote guidelines. The UK Financial Authorities comprising the Bank of England, PRA, and FCA have been canvassing the market on what these should look like since October 2022, publishing the results (FS2/23 – AI and Machine Learning) a year later which showed a strong demand for harmonisation with the likes of the AI Act as well as NIST’s AI Risk Management Framework.

Right now, this means financial providers find themselves in regulatory limbo. If we look at cyber security, for instance, firms are being presented with GenAI-enabled solutions that can assist them with incident detection and response but they’re not able to utilise that functionality because it contravenes compliance requirements. Decision-making processes are a key example as these must be made by a human, tracked and audited and, while the decision-making capabilities of GenAI may be on a par, accountability in remains a grey area. Consequently, many firms are erring on the side of caution and are choosing to deactivate AI functionality within their security solutions.

In fact, a recent EY report found one in five financial services leaders did not think their organisation was well-positioned to take advantage of the potential benefits. Much will depend on how easily the technology can be integrated into existing frameworks, although the GenAI and the Banking on AI: Financial Services Harnesses Generative AI for Security and Service report cautions this may take three to five years. That’s a long time in the world of GenAI, which has already come a long way since it burst on to the market 18 months ago.

Malicious AI

The danger is that while the sector drags its heels, threat actors will show no such qualms and will be quick to capitalise on the technology to launch attacks. FS2/23 makes the point that GenAI could see an increase in money laundering and fraud through the use of deep fakes, for instance, and sophisticated phishing campaigns. We’re still in the learning phase but as the months tick by the expectation is that we can expect to see high-volume self-learning attacks by the end of the year. These will be on an unprecedented scale because GenAI will lower the technological barrier to entry, enabling new threat actors to enter the fray.

Simply blocking attacks will no longer be a sufficient form of defence because GenAI will quickly regroup or pivot the attack automatically without the need to employ additional resource. If we look at how APIs, which are intrinsic to customer services and open banking for instance, are currently protected, the emphasis has been on detection and blocking but going forward we can expect deceptive response to play a far greater role. This frustrates and exhausts the resources of the attacker, making the attacks cost-prohibitive to sustain.

So how should the sector look to embrace AI given the current state of regulatory flux? As with any digital transformation project, there needs to be oversight of how AI will be used within the business, with a working group tasked to develop an AI framework. In addition to NIST, there are a number of security standards that can help here such as ISO 22989, ISO 23053, ISO 23984 and ISO 42001 and the oversight framework set out in DORA (Digital Operational Resilience Act) for third party providers. The framework should encompass the tools the firm has with AI functionality, their possible application in terms of use cases, and the risks associated with these, as well as how it will mitigate any areas of high risk.

Taking a proactive approach makes far more sense than suspending the use of AI which effectively places firms at the mercy of adversaries who will be quick to take advantage of the technology. These are tumultuous times and we can certainly expect AI to rewrite the rulebook when it comes to attack and defence. But firms must get to grips with how they can integrate the technology rather than electing to switch it off and continue as usual.

Continue Reading

Business

Recognising the value of protecting intellectual property early builds strong foundation for innovators

Innovation Manager at InnoScot Health, Fiona Schaefer analyses an essential facet of developing ideas into innovations

Helping the NHS to innovate remains a key priority during this period of recovery and reform. Even within the current cash-strapped climate, there is the opportunity to maximise the first-hand experience of the healthcare workforce and its knowledge of where new ideas are needed most.

Entrepreneurial-minded, creative staff from any discipline or activity are often best placed to recognise areas for improvement – the reason why a significant number of solutions come from, and are best developed with, health and social care staff.

NHS Scotland is a powerful driver of innovation, but to truly harness the opportunities which new ideas offer for development and commercialisation, the knowledge and intellectual property (IP) underpinning them needs to be protected. That vital know-how and other intangible assets – holding appropriate contracts for example – are key from an early stage.

Medical devices can take years to develop and gain regulatory approval, so from the outset of an idea’s development – and before revenue is generated – filing for IP protection and having confidentiality agreements in place are ways to start creating valuable assets. This is especially important when applying for patent protection because that option is only available when ideas have not been discussed or presented to external parties prior to application.

Without taking that critical initial step to protect IP, anyone – without your permission – could copy the idea, so anything of worth should be protected as soon as possible, making for a clear competitive advantage and ownership in the same sense as possessing physical property.

The common theme is that to be successful – and ultimately support the commercialisation of ideas that will improve patient care and outcomes – the idea must be novel, better, quicker, or more efficient than existing options. Furthermore, to turn it into a sound proposition worth investing in, it must also be technically and financially feasible. It isn’t enough to just be new and novel – the best innovations offer tangible benefits to patient outcomes and staff working practices.

Of course, even more so in the current climate of financial constraints, the key question of ‘Who will pay for your new product or service?’ needs to be considered up front as well.

Whilst development of a strong IP portfolio requires investment and dedicated expertise, when done well and at the appropriate time, then it is resource well spent, offering a level of security whilst developing an asset which can be built upon and traded. There are various ways commercialisation can progress and whilst not all efforts will be successful, intellectual property is an asset which can be licensed or sold to others offering a range of opportunities to secure a good return.

In my experience, however, many organisations including the NHS are still missing the opportunity to recognise and protect their knowledge assets and intellectual property early in the innovation pathway. This is partly due to lack of understanding – sometimes one aspect is carefully protected, whilst another is entirely neglected. In other cases, the desire to accelerate to the next stage of product development means such important foundational steps are not given the attention required for long-term success.

Good IP management goes beyond formally protecting the knowledge assets associated with a project, e.g. by patenting or design registration, however. When considered with other intangible assets such as access to datasets, clinical trial results, standard operating procedures, quality management systems, and regulatory approvals, it is the combination which will be key to success.

Early securing of IP protection or recognition of IP rights in a collaboration agreement, demonstrates foresight and business acumen. Later on, it can significantly boost negotiating power with a licensing partner or build investor confidence.

Conversely, omissions in IP protection or suitable contracts can be damaging, potentially derailing years of product development and exposing organisations to legal challenges and other risks. Failing to protect a promising idea can also mean commercial opportunities are missed, thus leading to your IP being undervalued.

Ideas are evaluated by formal NHS Scotland partner InnoScot Health in the same way whether they are big or small, a product, service, or new, innovative approach to a care pathway.

We encourage and enable all 160,000 NHS Scotland staff, regardless of role or location, to come forward with their ideas, giving them the advice and support they need to maximise their potential benefits.

Protecting the IP rights of the health service is one of the cornerstones of InnoScot Health’s service offering. In fact, to date we have protected over 255 NHS Scotland innovations. Recently these have included design registration and trademarks for the SARUS® hood and trademarks for SCRAM®, building and protecting a recognised range of bags with innovative, intuitive layouts. Spin outs such as Aurum Biosciences meanwhile have patents underpinning their novel therapeutics and diagnostics.

We assist in managing this IP to ensure a return on investment for the health service. Any revenue generated from commercialising ideas and innovations from healthcare professionals is shared with the innovators and the health board through our agreements with them and the revenue sharing scheme detailed in health board IP and innovation policies.

Fundamentally, we believe that it is vital to harness the value of expertise and creativity of staff with a well-considered approach to protecting IP and knowledge input to projects from the start.

Continue Reading

Copyright © 2021 Futures Parity.