Right Side Up

For about ten years now I’ve been banging on about buyer-centricity – the concept of a business that exists to work for and on behalf of the individual, helping the individual manage his or her relationship with the world out there, including organisations.

For a long time now, I’ve been working with Iain Henderson and others, including William Heath and David Alexander, to make this vision a reality.

Next week we announce publicly a test of the first working prototype of such a service: The Personal Data Store.

In preparation for this launch, we have published a White Paper (http://bit.ly/b1jvGN) which explores the concept in depth: what it does, how it works, what its implications are. I would be really interested in your comments.

PS: This is what the Press Release says:

30th September 2010

PRESS RELEASE

“The case for Personal Information Empowerment” –

Mydex publishes groundbreaking White Paper
Imagine a world where:

• Instead of signing companies’ terms and conditions and agreeing to their privacy policies every time you do business with them, they sign yours.

• Instead of people spamming you with messages, you choose who communicates with you about what, when – and can turn these communications on and off at will.

• You have much greater visibility and control over what organisations are doing with your personal information.

• You don’t have to remember a different password every time you log on to an Internet site.

• Instead of being tracked and monitored wherever you go online (or offline     for that matter), you collect your own data about yourself which companies pay to access.

• When you’ve got a complicated online form, you can fill it in almost automatically (and safely and securely) with just a few clicks, and automatically save a copy for your own records.

• When you move home or make other changes in your life, you don’t have to phone up or go online with dozens of different organisations jumping through their hoops set up for their convenience. Instead, you can tell them all at one go, simply by registering this change in your own personal database.

• Where governments and organisations can cut the cost of managing data and privacy protection whilst increasing security, efficiency and quality of service to individuals through a controlled exchange of information.

This is Mydex’s vision of the world outlined in its new White Paper: The Case for Personal Information Empowerment – The rise of the personal data store.

In the White Paper, Mydex * proposes that a fundamental shift in personal information management –  where individuals ‘own’ and manage their own personal data – transforms relationships between individuals and organisations with significant benefits for both sides. It is also the catalyst of an entirely new business and service eco-system of personal information management services.

The White Paper provides the context and ‘big picture’ for a unique live service – the Personal Data Store – which will shortly be trialled.

The Mydex service:

• helps people regain control of their personal data – so that they only share it with other people and organisations when they want to and how they want to.

• helps individuals turn their personal data into a personal asset which supports them in managing their lives better and which also saves them time and hassle and may even earn them a bit of extra cash

• uses next-gen internet technologies that transform users’ online experience (say goodbye to passwords, log-ins and cookies, for a start).

ENDS/

http://bit.ly/b1jvGN Mydex     White Paper: The Case for Personal Information Empowerment:                 The rise of the personal data store

* Mydex is incorporated as a Community Interest Company, which means that it is designed as a social enterprise that wants to use its profits and assets for the public good. Mydex’s social purpose is “to help individuals realise the value of their personal data”.

Tweet This Post

AlanMitchell 'The Information Age', Buyer centric services, Data, Privacy, vpi

Two  welcome bits of news this week from the UK.

First, BT has distanced itself from Phorm, the behavioural targeting advertising company that stalks individuals’ usage of internet sites to deliver more ‘relevant’ advertising to them.

In one sense, there is nothing wrong with the idea of building a profile of an individual’s web-surfing habits and using that information to serve up relevant information. Where Phorm went wrong was that it tried to do it behind individuals’ backs, without their knowledge or permission.

Now. Turn the Phorm proposition on its head, so that individuals use exactly the same technology to build up a profile of their own activities, and are then able to bundle bits of the profile into packages (‘this is the research I have done for my new holiday’, ‘this is the research I have for my new car’) and to selectively disclose this information to organisations they want to do business with and trust.

Hey presto! All of Phorm’s privacy invasion issues disappear as the technology becomes a tool of consumer empowerment. And advertisers actually get much better value from it!

When, oh when, will marketers and advertisers see that their current adversarial, targeting mindset is precisely why their initiatives are so inefficient, ineffective and (as with Phorm) counterproductive?

The second bit of news is the Tories’ announcement that they might turn to companies like Google or Microsoft to help build personal health records, as opposed to the current approach of centralised NHS (i.e. organisation-centric) medical records that has been a dismal failure and cost the citizens of this country £18bn so far.

As the Tories are likely to be the next government, this is significant, which is why The Times carried a lead front page story on it. Unfortunately, The Times got the wrong end of the stick (they are still working to an old and out of date political agenda). The issue is not who holds the data – state organisations or private sector organisations – but who controls the data: individual or organisation.

The Tories have woken up to what Phorm hasn’t – The Times reports a Tory spokesman talking about the need for people to ‘own’ their own data. Is Google or Microsoft the right organisation to facilitate this?  Not in my view, but then I’m biased because of my involvement with Mydex whose mission in life is to help individuals do exactly that.

But the key point is this. It’s now becoming clear that the issue of helping individuals ‘own’ and manage their own information is moving rapidly from the ‘far out’ fringe to the mainstream.

About time too!

Alan Mitchell

Tweet This Post

AlanMitchell 'The Information Age', Data, Marketing, Privacy, vpi

Cross-post from my CRM..meet VRM blog.

This post is a short(ish) summary of a working session led by Drummond Reed and me at the recent West Coast VRM Workshop, and also an introduction to the Kantara workgroup in which we are going to move this debate forward. It is also part of the thinking that will short emerge in a Mydex white paper.

At the VRM workshop, we discussed the need for the concept of the Personal Data Store, what it would do in practice, and what that will ultimately enable.

Why we need such things – because individuals have a complex need to manage personal information over a lifetime, and the tools they have at their disposal today to do so are inadequate. Existing tools include the brain (which is good but does not have enough RAM, onboard storage, or an ethernet socket……thankfully), stand alone data stores (paper, spreadsheets, phones, which are good but not connected in secure ways that enable user-driven data aggregation and sharing), and supplier based data stores (which can be tactically good but are run under the supplier provided terms and conditions). NB Our current perception of ‘personal data stores’ is shaped by the good ones that are out their (e.g. my online bank, my online health vault); what we need is all of that functionality, and more – but working FOR ME.

What they will do/ enable – the term Personal Data Store is not an ideal term to describe a complex set of functions, but it is what it is until we get a better one (the analogy I’d use in more ways than one is the term ‘data warehouse’ – again a simplistic term that masks a lot of complex activity). A Personal Data Store can take two basic forms:

Operational Data Stores – that get things done, and only need store sufficient breadth and depth of data to fulfill the operation they are built for (e.g. pay a credit card bill, book a doctor’s appointment, order my groceries).

Analytical Data Stores – that underpin and enable decision making, and which typically need a more tightly defined, but much deeper data-set that includes data from a range of aspects of life rather than just that from one specific operation (e.g. plan a home move, buy a car, organise an overseas trip).

A sub-set of the individual’s overall data requirement will lie in both of the above, this being the data that then integrates decision-making and doing.

In both cases, the functionality required is to source, gather, manage, enhance and selectively disclose data (to presentation layers, interfaces or applications).

We also discussed ‘who has what data on you’ and introduced the following diagrams to explain current state and target state (post deployment of Volunteered Personal Information (VPI) tech and standards).

The key terms that require explanation are:

My Data – is the data that is undeniably within, and only within, the  domain of an individual. It’s defining characteristic is that it has demonstrably not been made available to any other party under a signed, binding agreement. This space has been increasingly encroached upon by technology and organisations in recent history (e.g. behavioural tracking tools like Phorm) and this encroachment will continue. Indeed a general comment can be made that ‘my data’ equates to privacy in the context of personal data; so the rise of the surveillance society and state is a direct assault on ‘My Data’. Management of ‘My Data’ can be run by the individual themselves, or outsourced to a ‘fourth party service’.

Your Data – is the data that is undeniably within the domain of an organisation; either private, public or third sector. Proxy views of this data may exist elsewhere but are only that. This data would include, for example, the organisations own master records of their product/ service range, their pricing, their costs, their sales outlets and channels. Customer-facing views of much of Your Data is made available for reproduction in the ‘Our Data’ intersect.

Our Data – is the data that is jointly accessible to both buyer and seller/ service provider, and also potentially to any other parties to an interaction, transaction or relationship. It is the data that is generated through engaging in interactions and transactions in and around a customer/ supplier relationship. Despite being ‘our’ data, it is probably technically owned, or at least provided under terms of service designed by the seller/ service provider; in practical terms this also means that the seller/ service provider dictates the formats in which this data exists/ is made available.

Their Data – is the data built/ owned/ sold by third party data aggregators, e.g. credit bureaux, marketing data providers in all their forms. It’s defining characteristic is that it is only available/ accessible by buying/ licensing it from the owner.

Everybody’s Data – is the public domain data, typically developed/ run by large, public sector(ish) entities including local government (electoral roll), Post Offices (postal address files), mapping bureau (GIS). Typically this data is accessible under contract, but the barriers to accessing these contracts are set low – although often not low enough that an individual can engage with them easily.

The Basic Identifier Set/ Bit in the Middle – this is the core personal identity data which, like it or not, exists largely in the public domain – most typically (but not exclusively) as a result of electoral rolls being made available publicly, and specifically to service providers who wish to build things from them. This characteristic is that which enables the whole personal eco-system and its impact on data privacy to exist, with the individual as the un-knowing ‘point of integration’ for data about them.

The ovals in the venn diagram represent the static state, i.e. where does data live at a point in time. The flow arrows show where data flows to and from in this eco-system; I use red to signify data flowing under terms and conditions NOT controlled by the individual data subject.

Flow 1 (My Data to Your Data, and My Data to Our Data) – Individuals provide data to organisations under terms and conditions set by the organisation, the individual being offered a ‘take it or leave it’ set of options. Some granularity is often offered around choices for onward data sharing and use, i.e. the ‘tick boxes’ we all know and which are one of the main bitsof legacy CRM that VRM will fix.

Flow 2 (Your Data to Your Data, including Our Data) – Organisations share data with other organisations, usually through a back-channel, i.e. the details of the sharing relationship are typically not known to the data subject.

Flow 3 (Your Data, including Our Data to Their Data) – Organisations share data with a specific type of other organisation, data aggregators, under terms and conditions that enable onward sale. Typically the sharer is paid for this data/ has a stake in the re-sale value.

Flow 4 (Everybody’s Data to Their Data) – Data Aggregators use public domain data sources to initiate and extend their commercial data assets.

The target state is shown below, a different scenario altogether – and one which I believe will unfold incrementally over the next ten years or so…..data attribute by data attribute, customer/ supplier management process by customer/ supplier management process, industry sector by industry sector. In this scenario, the individual and ‘My Data’ becomes the dominant source of many valuable data types (e.g. buying intentions, verified changes of circumstance), and in doing so eliminates vast amounts of guesswork and waste from existing customer/ citizen managment processes.

The key new capabilities required to enable this to happen are those being worked on in the User Driven and Volunteered Personal Information work groups at Kantara (one tech group, one policy/ commerce one), and elsewhere within and around Project VRM. The new capabilities will consist of:

- personal data store(s), both operational and analytical

- data and technical standards around the sharing of volunteered personal information

- volunteered personal information sharing agreements (i.e. contracts driven by the individual perspective, creative commons-like icons for VPI sharing scenarios)

- audit and compliance mechanics

Around those capabilities, we will need to build a compelling story that clearly articulates, in a shared lexicon (thanks to Craig Burton for reminding us of the importance of this – watch this space), the benefits of the approach – for both individuals and organisations.

The target state that will emerge once these capabilities begin to impact will include the 4 additional individual-driven information flows over and above the current ones. The defining characteristic of these new flows is that the can only be initiated by the data subject themselves, and most will only occur when the receiving entity has ‘signed’ the terms and conditions asserted by the individual/ data subject. The new flows are:

Flow 5 (My Data to Your Data (inc Our Data) – Individuals will share more high value, volunteered information with their existing and potential suppliers, eliminating guesswork and waste from many customer management processes. In turn, organisations will share their own expertise/ data with individuals, adding value to the relationship.

Flow 6 (Everybody’s Data to My Data) – With their new, more sophisticated personal information management tools, individuals will be able to take direct feeds from public domain sources for use on their own mashups and applications (e.g. crime maps covering where I live/ travel)

Flow 7 (My Data to (someone else’s) My Data) – An enhanced version of ‘peer to peer’ information sharing.

Flow 8 (My Data to Their Data) – The (currently) unlikely concept of the individual making their volunteered information available to/ through the data aggregators. Indeed we are already starting to see the plumbing for this new flow being put in place with the launch of the Acxiom Identity Card.

The implications of the above are enormous, my projection being that over time some 80% of customer management processes will be driven from ‘My Data’. I’m pretty confident about that, a) because we are already see-ing the beginning of the change in the current rush for ‘user generated content’ (VPI without the contract), and b) because the economics will stack up. Organisation need data to run their operations – they don’t really mind where it comes from. So, if a new source emerges that is richer, deeper, more accurate, less toxic – and all at lower cost than existing sources; then organisations will use this source.

It won’t happen overnight obviously; as mentioned above specific tools, processes and commercial approaches need to emerge before this information begins to flow – and even then the shift will be slow but steady, probably beginning with Buying Intention data as it is the most obvious entry point with enough impact to trigger the change. That said, the Mydex social enterprise already has a working proof of concept up and running showing much of the above working. A technical write up of the proof of concept build can be found here. And the market implications of this are explored in more detail in new research on the market value of VPI shortly to be published by Alan Mitchell at Ctrl-Shift.

The two hour session at the VRM workshop was barely enough to scratch the surface of the above issues, so the plan is to continue the dialogue and begin specifying the capabilities required in detail in the User Driven and Volunteered Personal Information (technology) workgroup at The Kantara Initiative. The workgroup charter can be found here. A parallel workgroup focused on business and policy aspects will also be launched in the next few weeks. Anyone wishing to get involved in the workgroup can sign up to the mailing list here and we’ll get started with the work in the next couple of weeks.

Tweet This Post

Iain Henderson Data, Privacy, Project VRM, vpi

This week has seen much press coverage of Google’s initiative to collect and analyse individuals’ search histories in order to provide more relevant, personalised search results.

If you type in the search time ‘golf’, it points out, its current search algorithm doesn’t know if you mean Golf as in VW Golf the motor car, or golf as in the game golf. But if it has a history of your previous searches, it will have a pretty good idea of which one you mean.

So collecting personalised search histories represents a win-win-win, says Google: the searcher benefits from more relevant results, advertisers benefit from search-related ads that are also more relevant, so Google benefits.

But Google’s initiative has caused a minor uproar. How much more intrusive can you get than a search engine collecting a personalised history of your own personal searches? The privacy implications are huge.

Peter Fleischer, Google’s global privacy counsel has responded to these concerns with this argument:

“Our policy puts the user in charge,” he says. “It is not something Google seeks to control. At any time they can turn off personal search, pause it, remove specific web history items or remove the whole lot. If they want, they can take the whole lot to another search engine. In other words personalised search is only available with the consent of the user.”

With this, Google has made a big step forward. It has understood the difference between ‘permission’ in abstract (which in many marketing circles is taken to mean permission to spam and do whatever we want with your personal information) and permissions, plural.

Permissions management is one of the key ingredients of tomorrow’s information management infrastructure. Permissions are always contingent and context based: what I want to do right now, with whom, how much I trust them, and so on.

It’s also intriguing that Google are creating a facility that allows you to take this history to another search engine. This recognises the fact that strictly speaking this data is not Google’s, it’s yours to use and share (or not share) as you wish.

There’s another way in which Google’s initiative represents a step forward. By accepting that blanket algorithms don’t deliver personalised value, Google is accepting that the real power in search is not its algorithm per se, but the input of information from the user. It’s moving further towards a bottom up approach, rather than a top down one.

Nevertheless, two big issues still remain unresolved.

First, which side of the fence should the information reside on: in my database or Google’s database?

Fleischer claims that for personalised search to work, “search engines must have access to your web search history.” But what does ‘have access to’ mean? Does it mean that Google collects and keeps the data unless told otherwise; or that the individual is given the means to keep the data and then allows access to it?

Second, is this really the best way forward for personalisation?

The traditional corporate mindset assumes that personalisation is delivered by the company to the user via the expensive and cumbersome process of collecting as much information about the individual as possible and then data mining this information to create guesses about what might be relevant to that individual.

This is Google’s approach too. It is still making a guess about which golf you are interested in when, in reality, it could simply ask you.

This alternative approach goes in completely the opposite direction. It is based on enabling individuals to provide ever richer specifications, using ever-easier processes to do so.

In the search for ‘golf’, for example, why doesn’t Google develop a pop-up or drown down menu which simply asks ‘do you mean VW Golf or the game golf?’.  This would allow the user to specify, without

Google needing to collect any personal search histories at all.

So, even though Google is saying the right things, it’s still travelling in the wrong direction: two steps forward coupled with two steps back.

As a result, privacy concerns about Google can only grow and grow.

Until corporations understand and accept that the future lies in individuals owning and managing their own personal data, these stalemates will continue.

But the breakthrough in understanding seems to be getting closer.

Alan Mitchell

25 May 2007

Tweet This Post

AlanMitchell Data, Privacy Add new tag, Data