presentation to privacy+security forum market research and big data … · 2019-10-14 · - owns or...

Presentation to Privacy+Security Forum

MARKET RESEARCH andBIG DATA vs. CCPA and DSARS

Rachel Glasser

Chief Privacy OfficerWunderman Thompson

Gary A. Kibel

PartnerDavis & gilbert LLPDigital Media,Technology & [email protected]

@GaryKibel

Kim Leonard Smouter

Head of Public Affairs andProfessional [email protected]

Presentors

Rachel Glasser

Chief Privacy OfficerWUNDERMAN THOMPSON

Gary Kibel

PartnerDAVIS & GILBERT

Kim Smouter-Umans

Head of Public Affairs &Professional StandardsESOMAR

WHAT ISMARKET RESEARCH?

» Market research is "the process or set of processes that linksthe producers, customers, and end users to the marketerthrough information used to identify and define marketingopportunities and problems; generate, refine, and evaluatemarketing actions; monitor marketing performance; andimprove understanding of marketing as a process.

» It is the systematic gathering, recording, and analysis ofqualitative (in person and focus groups) and quantitative(surveys) data about issues relating to marketing products andservices. The goal of marketing research is to identify andassess how changing elements of the marketing mix impactscustomer behavior.

https://en.wikipedia.org/wiki/Marketing_research

2

DATA ALCHEMY

Market research helps usunderstand “Why” peopledo what they do, rather than“what” they do. Merging 1P,3P and market research datawill provide a 360 view

Market Research and Big Data vs. CCPA And DSARS3

HOW DOESMARKET RESEARCH WORK?

MARKET RESEARCHCHALLENGES

GLOBAL REVENUE OF MARKET RESEARCH FROM 2008 TO 2017 (IN BILLION U.S. DOLLARS)

Global revenue of market research from 2008 to 2017

Note: Worldwide; 2008 to 2017

Further information regarding this statistic can be found on page 8.Source(s): ESOMAR; ID 242477

32.46 33.1534.52

39.47 39.52

43.246.13

44.07 44.4745.83

0

10

20

30

40

50

60

2008 2009 2010 2011 2012 2013 2014 2015 2016 2017

Re

ven

ue

inb

illio

nU

.S.

do

llars

44%

14%

6% 5% 5%

26%

0.0%

5.0%

10.0%

15.0%

20.0%

25.0%

30.0%

35.0%

40.0%

45.0%

50.0%

United States United Kingdom Germany France China Rest of the world

Ma

rke

tsh

are

Note: Worldwide; 2017


MARKET SHARE OF THE MARKET RESEARCH INDUSTRY WORLDWIDE IN 2017, BY COUNTRYMarket share of the market research industry worldwide by country 2017

25%

14%

10%

9%

8%

8%

6%

5%

5%

3%

2%

2%

1%

1%

1%

0.0% 5.0% 10.0% 15.0% 20.0% 25.0% 30.0%

Online quantitative research

Phone interviews

Other quantitative methods

Face-to-face

Mobile/ smartphone online quantitative research

Automated digital/ electronic surveys

Online traffic/ audience measurement

Other approaches

F2F group discussions/ focus groups

Online research communities

In-depth face-to-face interviews

Online Qual

Traditional ethnography

Mail

Mobile Qual

Share of total revenues

Surv

ey

meth

od

Note: Worldwide; 2017


GLOBAL DISTRIBUTION OF REVENUES IN MARKET RESEARCH BY METHOD OF SURVEY IN 2017Market research: global distribution of revenues by method of survey 2017

PRIVACY ENFORCEMENT


FTC Section 5

» “Unfair methods of competitionin or affecting commerce, andunfair or deceptive acts orpractices in or affectingcommerce, are herebydeclared unlawful.”

Regulation (EU) 2016/679of the European Parliament

» General Data ProtectionRegulation / GDPR

» 99 Articles / 173 Recitals


Personally Identifiable Information (PII)

» COPPA – “personal information”

» HIPAA – “protected health information”

» GLB – “nonpublic personal information”

» State security breach notification laws

Personal Data

» Any information relating to an identified oridentifiable natural person (‘data subject’)

» An identifiable natural person is one who can beidentified, directly or indirectly, in particular by referenceto an identifier such as:

- name, an identification number, location data, an online identifier or

- one or more factors specific to the physical, physiological, genetic, mental,economic, cultural or social identity of that natural person

California Consumer Privacy Actis the nation’s first

comprehensive consumerprivacy law

CCPA

duh

#NOSLIDES(courtesy Pedro Pavon, Salesforce)


BUSINESS VS. THIRD PARTYVS. SERVICE PROVIDER

Business Generally understood to mean the business that itself hasdirectly collected information about the consumer, in otherwords, the covered entity under the statute

Third Party Any person or entity other than the covered business withsome narrow exclusions

Service Provider A for profit entity (including a sole proprietorship) that receivespersonal information for a business purpose, processespersonal information on behalf of a covered entity, and has acontract with the covered entity with clauses that prohibit usesof the personal information beyond providing services to thecovered entity


CCPA – DATA ACCESS

»Consumers can request:

- Categories of data

- Categories of data sources

- Business purpose for collecting or selling data

- Categories of third parties with whom data shared

- Specific pieces of data

- Deletion

- PortabilityMarket Research and Big Data vs. CCPA And DSARS14

CCPA – DAMAGES

StatutoryDamages

$2,500 – violation

$7,500 – intentional violation

Private Rightof Action

Security breach only

OTHER STATES

(BESIDES CALIFORNIA)

Old Notice and Choice

New Transparency and Data Access

NEVADASB220

SENATOR CANNIZZARO (APRIL 8, 2019)

» My constituents have expressed frustration over anincreased number of robocalls, pop-up ads and emailsoffering services or products related to internetsearches…

» As we can see there is a trend in states taking on theissue of data privacy. Until this issue is addressed atthe federal level, it is incumbent on our State to ensureour residents are protected.

» While SB 220 will not solve all of these issues, it is animportant issue to discuss…

» Certainly, SB 220 is not as comprehensive as theGDPR; however, a number of states have also enactedvarious forms of data protection.


NEVADA - AN ACT RELATING TOINTERNET PRIVACY

» SB 220 – May 2019

» Effective October 1, 2019

» Applies to “Operators”

- Owns or operates an internet website or online service for commercialpurposes,

- Collects and maintains covered information from consumers who reside [in NV]and use of visit the internet website oronline service, and

- Purposefully direct activities towards the state


VERIFIED REQUESTS

» Consumers can make a verified request through a designated address directingthe business not to make any sale of the personal information the operator hascollected or will collect about the consumer

» “Designated request address” means an electronic email address,toll-free number or internet website

» 60 days to respond to the request


NV - DEFINITIONS

» “Covered Information” = “means any one or more of the following items of personallyidentifiable information about a consumer collected by an operator through an Internetwebsite or online service and maintained by the operator in an accessible form:

1. First and last name

2. Home or other physical address whichincludes the name of a street and thename of a cityor town

3. Electronic mail address

4. Telephone number

5. Social security number

6. Identifier that allows a specific person tobe contacted either physically or online

7. Any other information concerning aperson collected from the personthrough the Internet website or onlineservice of the operator and maintainedby the operator in combination with anidentifier in a form that makes theinformation personally identifiable

NV - DEFINITIONS

» “Sale” means the exchange of covered information for monetary consideration (1)by the operator (2) to a person for the person to license or sell the coveredinformation (3) to additional persons

» Exceptions:

- Vendors

- For providing product/service requested by the consumer

- Disclosures “consistent with the reasonable expectations of a consumerconsidering the context in which the consumer provided the [information.]”

- Affiliates

- Merger/saleMarket Research and Big Data vs. CCPA And DSARS23

NV – ENFORCEMENT & PENALTIES

» Enforcement by the NV Attorney General – no rulemaking required

» No private right of action (removed from original draft)

» AG – $5,000 for each violation

DATA MATCHING / MODELING

» Behavioral advertising

» Data appending

» Look-a-like modeling

» Deterministic vs. Probabilistic modeling

» CRM matching services

- Google; Facebook; Instagram; Twitter

» Data accuracy

» Geo targeting

» Device graphsMarket Research and Big Data vs. CCPA And DSARS25

PENDING LEGISLATION

NEW/PENDINGLEGISLATION

VERMONT – H.467(DATA BROKER PROTECTION ACT)

» “Data Broker” means a commercial entity that collects, assembles, or maintains personalinformation concerning individuals residing in Vermont who are not customers or employees ofthat entity for the purpose of selling or offering for sale, or other consideration, the personalinformation of a third party.

» “Personal Information” includes information that identifies, relates to, describes or is capable ofbeing associated with a particular individual. Includes internet usage history; profile thatincludes personality / characteristics

» Data brokers must register with the state

» Data brokers must annually report to the state on its activities

» “Know your customer”

» Enacted

» First reports due January 2019

CALIFORNIA – DATA BROKER LAW(AB 1202)

» “Data broker” means a business that knowingly collects and sells to third partiesthe personal information of a consumer with whom the business does not have adirect relationship.

» “Personal Information” = CCPA

» “Sale” = CCPA

» Register on AG website

- pay a fee

- provide contact information


DATA PROTECTION ISN’T A NEW TOPIC FORTHE SECTOR

Throughout its historymarket, opinion and socialresearch has deliveredinformation and insightsabout people’s behavior,needs and attitudes toinform decision making byproviders of goods andservices, governments,individuals and society atlarge.


THE SECTORIS EVOLVINGFAST IN THEDIGITAL SPACE

» Explosion of data sources

» Increasing reliance onpassive data

» Multiplication of partnership models

» Increasing desire to “target” insights

» Growth of the “Data Scientist”and new actors

New Passive Data Sources New Partnership Models

Customer-Centricity New ActorsMarket Research and Big Data vs. CCPA And DSARS31

GDPRIMPLEMENTATIONHAS SHAKENTHINGS UP

» Placed renewed focus aroundmeaningful transparency and consent

» Increased debate on “scientific”and “statistical” research vs profilingwith intent to take decisions

» Contractual discussions around datacontrollership

» Increased the need to invest in systemsfor both DSARs and data security DSARs and Data Security

A renewed focus…

Who is the controller?

What is Research?


SINCE 1948,THE SECTOR’SBEEN WORKINGON THIS:

» Enforceable Codes of Conducts

» Voluntary participation

» Consent

» No “Return-Path”

» Publication of guidelines

» Membership marks

Voluntary participation

Capacity-Building

On the basis of consent

No return path Enforced with sanctionsMarket Research and Big Data vs. CCPA And DSARS33

“The use of opinion polls by lobby groups is not to gather

information but to create false opinions and use those to make

politicians think the public is on the side of big money. We need to

get wiser about opinion polls or we’re going to start falling for this

stuff like they do in the US.”

Robin McAlpine


The sector’s increasingly having to contendalso with diminishing trust…

TRUST IS OF INCREASING CONCERNDESPITE EFFORTS

AND HIGH MEDIA PROFILE EVENTS HAVESHAKEN IT FURTHER


REDOUBLINGOUR EFFORTS

» Code of Conducts

» Capacity-building

» Support Services

» Research Choices

» Trust in Research

» #BeDataSmart

Codes of Conducts Capacity-Building New Services

Research Choices Trust in Research #BeDataSmart


LET’S STAYIN TOUCH:

Rachel GlasserChief Privacy Officer

[email protected]

Gary KibelPartner

[email protected]

@GaryKibel on Twitter

Kim Leonard SmouterHead of Public Affairs and Professional Standards

[email protected]

[email protected]

@esoGOV on Twitter

QUESTIONS

presentation to privacy+security forum market research and big data … · 2019-10-14 · - owns or...

Documents