home / articles

Big data and EU regulation

Legal and regulatory definitions ultimately matter less than what your customer believes or expects

'Big data' from consumer transactions seemingly offer a "win, win": 'They' collect data on your transactions and use these to deliver 'You' a targeted and relevant consumer offer; 'You' willingly opt-in to this relationship and 'They' then use these data to improve their organisational focus, efficiency and revenues. But who guards the guardians of your personal data? The growth of social media is adding to this dilemma.

The proposed European Union Data Protection Regulation was introduced in January 2012 and put forward reforms that represent the most significant overhaul of Europe's data protection and privacy laws since 1995.

The current Directives are implemented at national level in each nation's own terms, which led to differences in data protection within Europe. Regulations, however, must be enforced precisely as specified by the Council of the European Union. The purpose of the latest regulation is thus to harmonise data protection enforcement across Europe. EU plans are to make the regulation effective in January 2013.

The current reality across the EU is that the proposed regulation has widely different interpretations. The US Federal Trade Commission (FTC) has also added to the political debate with an Informal Note, provided to the European Commission in December 2011, focused on "two overarching concerns":

• "potential adverse effect on the global interoperability of privacy frameworks" - resulting in divergence rather than convergence of data privacy standards globally; and
• "serious implications for regulatory enforcement activities involving third countries" such as the USA - resulting in EU data protection laws presenting a significant obstacle to international enforcement cooperation.

In both respects, the Informal Note portrays the draft Regulation as a backward step that would have an adverse effect on the global interoperability of privacy regimes due to it increasing differences rather than promoting convergence.

When the focus on data privacy moves to a global perspective a pattern of wide variation in regulations governing privacy and data protection is also evident. This vastly complicates matters for organisations that operate with a global footprint.

In early-October this year, EU data protection commissioners said they believed Google was in breach of privacy laws due to its pooling of data. The concerns were instigated by changes in the way in which Google tied together the previously separate data collected under services including its search engine, YouTube and Google+. While creating a unified privacy policy across all the services, it also in effect amassed the data into a single location. Google is already under scrutiny by the European Commission's competition arm, which says that the way it orders its search results, uses other sites' content and controls some elements of advertising is anti-competitive.

In May 2011 a new EU-originated law came into effect that required website owners to obtain informed consent from visitors before they can store or retrieve any information on a computer or any other web connected device. Cookies are used by almost all websites to analysis of visitor behavior, personalise pages, remember visitor preferences, manage shopping carts in online stores, track people across websites and deliver targeted advertising.

The concept of data privacy is complex. The UK Direct Marketing Association (DMA) commissioned a recent study on how consumer attitudes to their privacy are being impacted by search engines, mobile apps and a huge growth in services dependent upon a concept of a "fair exchange of data". Two-thirds of consumers surveyed by the study agreed that their definition of privacy was changing due to the internet and social media.

Google, Amazon, LinkedIn and so on have a business model built around the ability to collect and interpret customer data more rapidly and accurately than those struggling with legacy systems. The big players in consumer loyalty programmes are also rapidly developing their expertise in this area, presenting at industry conferences on the basis that "data is the new oil" of the digital economy. The high degree of consumer participation in coalition, grocery retailing, store loyalty and FFP's is supporting the general acceptance of data exchange in return for improved offers or service levels.

The reality is that data privacy has many differing perspectives and individual consumers are inconsistent in their attitudes to privacy depending on the context of the issue in which it is raised. This makes it challenging for regulatory bodies to maintain a suitable framework with what is an evolving dynamic.

Loyalty programmes are justified on the basis of the data analysis that they can provide on consumers. Consumers are increasingly the gatekeepers of their own data and conditioned to expect more relevant, more individualised and better offers or service as "fair value" for exchanging their data. As the loyalty industry embraces big data, it seems likely that value of the information captured will grow commercially but the active members of these programmes will need to perceive greater value also flowing back towards them for "fair value" in this voluntary exchange to remain in balance. The evidence from some sectors in the loyalty market suggests a perceived relative decline in value.

The future success of this data-sharing relationship will depend on the level of trust between the consumer and brand. But trust can be a very fragile state. Break that trust and the result could be terminal for your brand.