1. Data Governance: Addressing the Big Data Challenge IT.CAN 2015 Information Technology Law Spring Forum May 4, 2015 Adam Kardash Partner, Privacy & Data Management Osler, Hoskin & Harcourt LLP akardash@osler.com

2. 2 Understanding Big Data  Multiple definitions emerging from government entities, privacy regulatory authorities, “thought leaders”, and academics.  No single universally-accepted articulation of the Big Data concept.

3. 3 Understanding Big Data  Common Themes in Definitions: Qualitative change in data arena  Massive (incalculable) volume of data  Unstructured data sets  Data ubiquity  High velocity (and increasing volume of) data “transactions”  Hyper-connectivity Proliferation of multi-stakeholder platforms “Internet of Things”

4. 4 Understanding Big Data  Common Themes in Definitions (Cont’d.): Proliferation of advanced, affordable analytics processes Conversion of data into knowledge New and enhanced insights Infinite potential for innovative creation of value Profound societal change

5. 5 Data Challenges to Fair Information Practices  Cited challenges posed by Big Data process Expanding application of data regulation Accountability stressors Impracticality of traditional consent models Reconciling purpose identification with search for unknown Data minimization of vast, instructed data sets Ensuring processing is “reasonable”/”legitimate” Transparency of complex data flows and processes Evolving safeguarding threat Access rights Data integrity of algorithms/inferences Retention Discrimination resulting from automated decision- making

6. 6 Data Governance Framework to Address Big Data Challenge  Key thematic trend in Practice: Board/Senior Management focus on Data  Help us leverage data holdings for beneficial purposes  Help us proactively address cybersecurity threat New data governance model emerging.

7. 7 Framework for Addressing the Big Data Challenge  Application and Scope Addresses lifecycle of data (including personal information) Umbrella integration of privacy governance, information security governance with enterprise risk framework.  Core Features Powered by values Data stewardship

8. 8 Framework for Addressing the Big Data Challenge  Data Values Operationalization of stated corporate values in data context. Values for ethical use of data  Example of data values: Beneficial Progressive Sustainable Respectful  Abrams, Marty (The Information Accountability Foundation). A Unified Ethical Frame for Big Data Analysis (2014). “Privacy by Design” as an operationalized value  PBD expressly recognized by data protection authorities globally.

9. 9 Framework for Addressing the Big Data Challenge  Data Stewardship Multi-stakeholder/cross enterprise involvement  Cross-functional skillset critical. Institutionalizing ownership of data use and risks in business lines/processes/units  Individuals designated as responsible. Accountable processes  Meaningfully embraced by Board/Senior management  Reporting mechanisms  Documented policies, protocols and controls  Risk assessment  Training and awareness  Incident response  Vendor management  Ongoing assessment, improvement Automated and manual assessments  Appropriate skillset of personnel