00:00:00 Dr Genevieve Hayes
Hello and welcome to value driven data science brought to you by Genevieve Hayes Consulting. I'm your host doctor, Genevieve Hayes, and today I'm joined by Maria Ferris to discuss creating order from data chaos in big insurers. Maria is an actuary with extensive experience throughout Europe.
00:00:21 Dr Genevieve Hayes
In Australia, who now specialises in establishing the enterprise data functions of multinational insurers, she is currently the Enterprise Data Officer at trade credit insurer a trade.
00:00:34 Dr Genevieve Hayes
Ideas and she also advises companies within the insure tech space on the use of data to comply with data protection laws. Maria, welcome to the show.
00:00:45 Maria Ferres
Thank you for having me, Genevieve.
00:00:47 Dr Genevieve Hayes
The insurance sector owes its existence entirely to data, and insurers were some of the first companies in history to utilise data expertise in the form of actuaries. Yet being an early adopter isn't always as great as it seems, and many big insurers are now discovering the challenges.
00:01:08 Dr Genevieve Hayes
Of bringing their long established data systems into the 21st century.
00:01:12 Dr Genevieve Hayes
In many ways, this task is one of creating order from chaos, but given the size of some of these organisations, it doesn't sound easy. Yet Maria, you've managed to build a career for yourself by doing just that. How did you end up becoming the go to person for big insurers?
00:01:32 Dr Genevieve Hayes
Wanting to build an enterprise data function, often from scratch.
00:01:36 Maria Ferres
Well, it's been a somewhat of a.
00:01:38 Maria Ferres
Long journey, as you know, I'm and.
00:01:40 Maria Ferres
Actually, very soon I realised all.
00:01:43 Maria Ferres
The fancy techniques and all the accuracies with six decimal points.
00:01:47 Maria Ferres
Kind of pale in comparison when you deal with the volume of data quality issues, so you like to be very precise with your model, but if 30% of the quality of the data you use is questionable, how accurate is really your output so.
00:02:04 Maria Ferres
Very soon I.
00:02:05 Maria Ferres
Realised that while at university we talk about.
00:02:07 Maria Ferres
The decision of calculation and accurate modelling the input to.
00:02:11 Maria Ferres
The to the model itself is also not.
00:02:14 Maria Ferres
Discussed we we kind of took it for.
00:02:16 Maria Ferres
Granted, that university that you have perfect data.
00:02:19
When you do your.
00:02:21 Maria Ferres
I very quickly started thinking how should we do?
00:02:24 Maria Ferres
This and as.
00:02:25 Maria Ferres
Actuarial department often struggle with their data quality. I became the person who we kind of divided the tasks in a way.
00:02:33 Maria Ferres
I said I.
00:02:34 Maria Ferres
Checked the data, clean it up, reconcile it.
00:02:37 Maria Ferres
Ensure it's complete and actually.
00:02:40 Maria Ferres
Done their work.
00:02:41 Maria Ferres
And then I do the peer.
00:02:42 Maria Ferres
Review because I wasn't actually involved in the process of doing the analysis, so it kind.
00:02:46 Maria Ferres
Of I came at the beginning at the end.
00:02:48 Maria Ferres
Of that process, at times when I was working as an actor.
00:02:52 Maria Ferres
And then slowly I thought I.
00:02:53 Maria Ferres
Should expect to see what else.
00:02:55 Maria Ferres
Is going on in the data scene.
00:02:57 Maria Ferres
And then in one.
00:02:58 Maria Ferres
Of my roles, I became the reporting managers financial reporting, including some of the actuarial topics and superannuation topics. And then I had to actually build the reporting structures from ground up, which required now for the first time dealing with enterprise architecture data architect, the back end, the system engineers.
00:03:17 Maria Ferres
And I realised that there may be even more data in the company that we are not using or data is sitting in legacy.
00:03:25 Maria Ferres
Systems we are not using.
00:03:26 Maria Ferres
So I have very early exposure to data issues and that is something that inspired me because it's actually don't have good data. Then we are kind of not cheating as much as.
00:03:37 Maria Ferres
We should be right.
00:03:39 Maria Ferres
So this is how my career kind of got started.
00:03:42 Maria Ferres
And then I as.
00:03:43 Maria Ferres
I became the go to person to build up the reporting.
00:03:46 Maria Ferres
Function which naturally sits on having proper data management master data metadata as the companies expanded.
00:03:54 Maria Ferres
Kind of took a step back the layer before the reporting the layer before you can actually have MI BI capabilities. So kind of you can think about me going from the very end of the process where it actually is to the reporting and and comment on it to kind of step by step walking backward to data sources and source management.
00:04:15 Maria Ferres
And all of.
00:04:16 Maria Ferres
That so my journey has been kind of by experience trying to get to the bottom of of a problem.
00:04:22 Maria Ferres
And as technology has grown, the problem hasn't become better because we kind of deploy tools as a way of solving a problem. That is really a data management and business problem. The tools have just meant that people can misuse and mismanage data.
00:04:42 Maria Ferres
And the larger scale and faster because the data function started way after the IT flourished and became mature. If you look into the companies having the CIO is kind of.
00:04:57 Maria Ferres
Take it for granted. You must have.
00:04:58 Maria Ferres
A CIO to.
00:04:59 Maria Ferres
To run an insurance company, however, a majority of insurance don't.
00:05:03 Maria Ferres
Have a CDO.
00:05:04 Maria Ferres
Which means there is the user there is technology.
00:05:07 Maria Ferres
And amount of.
00:05:08 Maria Ferres
Unmanaged data so you can sooner use.
00:05:12 Maria Ferres
And abuse the data.
00:05:13 Maria Ferres
Than actually really drive value from it.
00:05:16 Dr Genevieve Hayes
Before we recorded this episode, you described to me your job as being someone who brings order to data chaos data chaos is going to mean different things to.
00:05:27 Dr Genevieve Hayes
People so that everyone's on the same page. Can you describe what you mean by data chaos?
00:05:34 Maria Ferres
Data chaos means, for example, actuarial team decides we.
00:05:38 Maria Ferres
Need to do analysis A.
00:05:40 Maria Ferres
We go and get data. How do we get it? We go find it. Each group goes and negotiates kind of data that they hold. They have a data.
00:05:48 Maria Ferres
Source another hand, the underway.
00:05:50 Maria Ferres
Team may have a very similar problem. They go about it in a different way, so they use a different tool, different definitions, the gross written premium doesn't mean the same to everyone because one says Ohh, mine excludes a mine include. This revenue excludes, so the data definitions are not clear. So one of the first things I experienced is being.
00:06:11 Maria Ferres
In an executive meeting, and they were sitting for the better part of the meeting, arguing whose revenue values are.
00:06:20 Maria Ferres
Because the sales department was dead and there was the finance department with different information, then you had the strategy with the different numbers and projections and they couldn't agree on the numbers. So that is for me the definition of chaos that you don't know what is the truth.
00:06:35 Maria Ferres
So where does that come from? Is the fact that there is no control over the definition definitions across the company? There is no control over duplication of sources actually, or takes a copy of this database. Then they do something with it, then they.
00:06:48 Maria Ferres
Copy it again.
00:06:50 Maria Ferres
If you look at, for example, process models each.
00:06:53 Maria Ferres
Person goes in and.
00:06:54 Maria Ferres
Creates their own variable because they're trying to run.
00:06:56 Maria Ferres
Something and there's no control at some point.
00:06:58 Maria Ferres
10 years down the lane, you end up with 300 calculations. Each person has named it their own.
00:07:04 Maria Ferres
Way. So there is basically no.
00:07:06 Maria Ferres
Gatekeeper to the IT business activities that leads to a result. They are ungoverned.
00:07:13 Maria Ferres
As a matter of.
00:07:13 Maria Ferres
Speaking so this is 1 version of.
00:07:15 Maria Ferres
Chaos. We don't know what's true. What's not.
00:07:18 Dr Genevieve Hayes
Point in time also be another issue that you'd face there.
00:07:21 Dr Genevieve Hayes
So one group is getting their data at this point in time and another at another point in time.
00:07:28 Maria Ferres
Of course, the rolling 12. The end.
00:07:30 Maria Ferres
Of the year.
00:07:31 Maria Ferres
You know, financial year end financial year end is not always matching the you know the the calendar.
00:07:37 Maria Ferres
Year end and.
00:07:38 Maria Ferres
So there is a lot of those type of issues going on. The chaos is is actually unsustainable in the long term in my opinion.
00:07:46 Maria Ferres
And in part because technology gives capabilities to business, to do stuff with with the data. So before copying a database was not so easy because you didn't have a space and you didn't have the memories and.
00:08:01 Maria Ferres
You but now.
00:08:02 Maria Ferres
You can just replicate all sorts of things I.
00:08:05 Maria Ferres
Have spoken to.
00:08:06 Maria Ferres
Details and who tell me they spend so much.
00:08:09 Maria Ferres
Money on storage.
00:08:10 Maria Ferres
And they don't know where the copies are. There are multiple copies, so when we should have a disaster recovery situation.
00:08:17 Maria Ferres
The team that does the.
00:08:18 Maria Ferres
Disaster recovery doesn't know which version.
00:08:20 Maria Ferres
They need to recover because there is 5 copies in this. In this location, there's another 3 copies there. Both of them have been used at the same time. So what do we recover?
00:08:30 Maria Ferres
And where do we?
00:08:30 Maria Ferres
What that?
00:08:31 Maria Ferres
Is, is is some of the issues.
00:08:33 Dr Genevieve Hayes
Do these organisations have data warehouses?
00:08:36 Maria Ferres
Yes, and a lot of the issue becomes when you geographically dispersed and subjected to different regulations and sometimes through acquisition companies.
00:08:46 Maria Ferres
Drone creating one central warehouse is not so easy and then becomes the issue of ownership and data protection if.
00:08:56 Maria Ferres
You create one.
00:08:57 Maria Ferres
Big data warehouse access management can become somewhat difficult. Who can access what tables you have to have very good controls the the.
00:09:06 Maria Ferres
Capabilities must be available to manage that. We are past the days where actual team and finance were the only ones using the data handles. We're a small team, so you can.
00:09:16 Maria Ferres
Just say OK.
00:09:17 Maria Ferres
You can self manage now we are talking about.
00:09:20 Maria Ferres
MIDI capabilities that sits on a massive database. So yes, some of them do have it, some have multiple, some are hoping to can have one, but the requirements are very unclear. They're slow moving, you know variables and fast moving variables are.
00:09:35 Maria Ferres
What needs to?
00:09:36 Maria Ferres
Be kept for audit.
00:09:37 Maria Ferres
And what needs to be you?
00:09:38 Maria Ferres
Know live data and.
00:09:40 Maria Ferres
The timing of updating of various tables.
00:09:43 Maria Ferres
So it does require quite a lot of coordination to maintain and create.
00:09:47 Dr Genevieve Hayes
And the bigger the company and the more countries it's in and the more subsidiaries it's going to just get worse exponentially.
00:09:54 Dr Genevieve Hayes
Right. Other than actuaries and IT staff, what other sorts of data staff do these organisations typically have when you arrive?
00:10:04 Maria Ferres
Though they have the IT, there is actuarial also in times there is legal and compliance and risk management involved in compliance matters. As you know anti money laundering and then fraud management and so they also need access to data. For instance in one instance actually don't really need personal data for policy.
00:10:24 Maria Ferres
Orders because you just cut that data out, especially if you're having the portfolio that is underwritten somewhere else.
00:10:31 Maria Ferres
Actually do the calculation. However, the compliance department may need first name and last name and date of birth. Those may not have been captured originally in the.
00:10:39 Maria Ferres
Policy system so they can't do.
00:10:42 Maria Ferres
That kind of cheques.
00:10:43 Maria Ferres
That they need to.
00:10:44 Maria Ferres
Do so when creating a warehouse. You can't solely cater to the actual real team because they often only want.
00:10:51 Maria Ferres
Aggregated anonymous data. They don't really care about names.
00:10:54 Maria Ferres
Etcetera, you're reserving.
00:10:56 Maria Ferres
You don't. You don't really need name and postal address.
00:10:59 Maria Ferres
On the other hand, you have.
00:11:00 Maria Ferres
Other teams that do.
00:11:01 Maria Ferres
Need that information in particular jurisdictions is regulation to check that the.
00:11:05 Maria Ferres
Policy is not sold to someone on.
00:11:07 Maria Ferres
The blacklist or sanctions list you need to really understand when you're creating something for enterprise. It needs to meet everybody's.
00:11:17 Dr Genevieve Hayes
Including the legal requirements.
00:11:20 Maria Ferres
Of each country does.
00:11:21 Dr Genevieve Hayes
Even if you hadn't actually did want to get access to the personal information, I doubt it would be legal for them to have that sort of access.
00:11:30 Maria Ferres
It's it's on the need to.
00:11:32 Maria Ferres
Have basis and.
00:11:33 Maria Ferres
Then the issue becomes retention. In some countries it says once you no longer need data, you need to delete it and this.
00:11:41 Maria Ferres
Time frame varies.
00:11:42 Maria Ferres
From country to country, so let's just say you have a table with personal data and financial data. The financial portion may need to be kept for 10 years.
00:11:51 Maria Ferres
The personal portion we no longer need.
00:11:53 Maria Ferres
Because the policy has lapsed and it's.
00:11:55 Maria Ferres
Closed and you know the the.
00:11:57 Maria Ferres
Period had so we need.
00:11:58 Maria Ferres
To think about to be masked, to be anonymized.
00:12:01 Maria Ferres
Do we make it?
00:12:02 Maria Ferres
Aggregate for actuarial use. How do we treat it? And then especially if these sit in different jurisdictions?
00:12:08 Maria Ferres
Then you need to.
00:12:09 Maria Ferres
Manage the retention which is.
00:12:11 Maria Ferres
Quite a complex topic.
00:12:13 Dr Genevieve Hayes
I don't know if you heard about what happened in Australia a few months back, but we had a number of companies who were hacked here and they've been keeping data for customers that had left ages ago for decades. And yeah, and then that all got leaked so.
00:12:29 Dr Genevieve Hayes
I think it's very important that companies get rid of data they don't need as.
00:12:33 Dr Genevieve Hayes
Soon as possible.
00:12:35 Maria Ferres
There's a holding data culture.
00:12:37 Maria Ferres
Going on and and this is because data was so scarce at some point in time.
00:12:41 Maria Ferres
Just squeezed as much.
00:12:43 Maria Ferres
As we could from this tiny database we all shared. Now there is mountains of data coming in the data capture because of technology has much.
00:12:54 Maria Ferres
And the data is uncontrollable. A day the volume of data we hold is kind of unsustainable and I I am estimating we really only use 20 to 30% of the data we hold, which means 70% of data is just creating constant risk because if you have a cyber incident and let's say.
00:13:12 Maria Ferres
You've been keeping.
00:13:13 Maria Ferres
Data from 30 years.
00:13:15 Maria Ferres
Ago, you've been holding to mailboxes of everyone who's left.
00:13:18 Maria Ferres
If you're hacked, you don't know.
00:13:20 Maria Ferres
What is in that?
00:13:22
Data you don't.
00:13:22 Maria Ferres
Know what categories data is in and you.
00:13:25 Maria Ferres
Don't know how much risk you're exposed to.
00:13:26 Maria Ferres
Is there hacked you?
00:13:28 Maria Ferres
Don't even know sometimes who to notify because you may not have the active address, but you may have certain data about the people whose information has been taken. So my my point.
00:13:38 Maria Ferres
Would be delete, delete, delete what you don't need?
00:13:41 Dr Genevieve Hayes
So you've told us what chaos looks like. What's the utopian state that these organisations want to get to?
00:13:48 Dr Genevieve Hayes
2:00.
00:13:49 Maria Ferres
I think the utopian state requires quite a bit of investment, I think.
00:13:54 Maria Ferres
To get there, there's.
00:13:55 Maria Ferres
A degree of denial about foundational work that is involved in being data driven people throw that around because being data driven is the utopian state and people don't know how much.
00:14:09 Maria Ferres
Efforts and work goes into it now.
00:14:11 Maria Ferres
Some of the.
00:14:12 Maria Ferres
Fundamental mistakes that companies make is that governing data is a top down.
00:14:17 Maria Ferres
Exercise, which means go big or go home. You cannot govern when you have a tiny team at the bottom of the organisational hierarchy saying that this is our team. You're gonna scale up. You cannot scale up data. You cannot come up with the master data for one unit and then expand that to the master data. You can't.
00:14:37 Maria Ferres
It is not something that is easily scalable. Secondly, data themes are all very much interrelated.
00:14:46 Maria Ferres
All of them need to hit a minimum maturity before you can prioritise what can wait and what needs to happen. Now you cannot not just start all the lanes of data, and that includes governments, metadata, master data, data management involves retention, data protection, data security.
00:15:07 Maria Ferres
All of them need to reach a minimum measurement.
00:15:09 Maria Ferres
Before you can.
00:15:10 Maria Ferres
Start prioritising. Otherwise you have to.
00:15:13 Maria Ferres
You build something, then you have to break it down and build it again because you have forgotten.
00:15:17 Maria Ferres
To factor in such and such compliance matters.
00:15:20 Maria Ferres
So this is where the companies are struggling to hit that data driven is because it's a top down exercise.
00:15:28 Maria Ferres
What does that mean?
00:15:29 Maria Ferres
Top down exercise.
00:15:30 Maria Ferres
Means that the decision on data assets needs to come from the top and trickle downward. The governance of the data, in my opinion.
00:15:40 Maria Ferres
When you say that you're data driven, my next question is who is your Chief Data officer? If you do not have an answer to?
00:15:48 Maria Ferres
That question you are not data.
00:15:49 Maria Ferres
Metric and the example.
00:15:51 Maria Ferres
I give is if you say you are.
00:15:52 Maria Ferres
Very customer oriented.
00:15:54 Maria Ferres
And I asked you who is?
00:15:56 Maria Ferres
Your chief customer service.
00:15:57 Maria Ferres
Officer and you say we have one or two people in legal who answer complaints. That does not exactly signal to.
00:16:05 Maria Ferres
Me that you are.
00:16:05 Maria Ferres
Dated now where should the data function sit? It's another question because the utopian state heavily relies on those who.
00:16:14 Maria Ferres
Govern and control the.
00:16:16 Maria Ferres
In my opinion, the closer to the chief executive, the head of data is, the higher the chance.
00:16:21 Maria Ferres
Of success as.
00:16:23 Maria Ferres
You move the head of data one layer.
00:16:25 Maria Ferres
Down your chances of success.
00:16:28 Maria Ferres
For each level that the chief data.
00:16:30 Maria Ferres
Officer is below the sea.
00:16:32 Maria Ferres
Why? Because somebody needs to speak and advocate.
00:16:36 Maria Ferres
The data and this voice cannot be filtered through someone.
00:16:40 Maria Ferres
Whose priorities are?
00:16:41 Maria Ferres
Something else if the data is being the largest asset someone needs to objectively talk for data. If you manage also data protection, you cannot report to a function that heavily processes personal data to create a conflict. So that excludes to some degree COCUO.
00:17:02 Maria Ferres
So you start going by process of elimination and you find that there is.
00:17:06 Maria Ferres
Really only one.
00:17:07 Maria Ferres
Two ideal places for the data to sit, and that's for me directly, either under CEO or another C who doesn't process data themselves. Otherwise they prioritise their own activities ahead of other. So the utopian society for me would be a company whereby data.
00:17:27 Maria Ferres
Appears on every performance objective.
00:17:30 Dr Genevieve Hayes
Imagine that a lot of organisations would try and put the Chief Data officer under the Chief Information Officer.
00:17:37 Maria Ferres
We cannot be technology driven when we are dealing with managing it is business requirements data.
00:17:46 Maria Ferres
Two last two must come as a result of complete negotiations and requirements between the data and the business.
00:17:54 Maria Ferres
The tool is the last Haver technology driven solutions is what has created the problem. You deploy your tool, people start copying, multiplying and creating more and more reports. Thousands of reports which nobody uses. There's no coordination, there's no governance over the reporting. And then you have a bridge, a leak.
00:18:15 Maria Ferres
A system goes down. There is no proper backup, there is no proper classification of the.
00:18:20 Maria Ferres
Data that's gone.
00:18:20 Maria Ferres
Missing. So this is what I mean that.
00:18:23 Maria Ferres
If you put it under the CIO, we need to make sure that the CIO is not leading with technology. There lies the problem. It can sit there. I'm not saying each organisation needs to at some point to start somewhere if they don't want.
00:18:38 Maria Ferres
To go immediately under.
00:18:39 Maria Ferres
The CEO, they can't put under CSO, but they need to be aware.
00:18:43 Maria Ferres
In the long term, there needs to be a path offered, and so that's where I was going. That's problem is there was data obligations on all of us. Data is a shared asset and we all have responsibilities. However, I find it very hard to see on any persons performance object.
00:19:03 Maria Ferres
Their obligations to the data if you own data, you need to make sure it's retained. You need to make sure it's not copied without authorization and approval. You need to make sure that the data is.
00:19:12 Maria Ferres
Accurate you need.
00:19:14 Maria Ferres
To take some responsibilities for the data that you are using and and servicing, but I don't see those on performance objectives therefore.
00:19:23 Maria Ferres
You're putting the entire burden of a shared asset on the data function.
00:19:28 Maria Ferres
So this is.
00:19:29 Maria Ferres
One thing it.
00:19:29 Maria Ferres
Needs to sit at.
00:19:30 Maria Ferres
The top such that the obligations everybody has comes with training, proper policy monitoring and it is on your objectives. Part of my job as an actor is to ensure I adhere to the data catalogue that I update the catalogue, that I have, that I.
00:19:48 Maria Ferres
Notify any issues with master data that.
00:19:50 Maria Ferres
I will like you.
00:19:51 Maria Ferres
Know source issues to the correct.
00:19:53 Maria Ferres
Path those needs to be.
00:19:55 Maria Ferres
On my objectives, why? If not?
00:19:58 Maria Ferres
I'll just say I'll just create another definition.
00:19:59 Maria Ferres
Of one and then.
00:20:00 Maria Ferres
Later, when the reports are trying to reconcile, they won't because there is a new heading that no one has ever no one has ever seen.
00:20:07 Maria Ferres
Before. So this is where I think the ideal.
00:20:11 Maria Ferres
Organisation would be to have established mature data function and then people.
00:20:15 Maria Ferres
Be aware of their obligations.
00:20:17 Dr Genevieve Hayes
When I've worked in organisations in the past where they've tried to bring in data of governance, there's been a lot of resistance to it. It's seen as being this annoying chore that the organisations making people undertake. I could imagine what you've just described with people having data responsibilities on their position.
00:20:38 Dr Genevieve Hayes
Statement would also be met with a lot of resistance. Is that what you've experienced in practise?
00:20:44 Maria Ferres
I think if it is under.
00:20:46 Maria Ferres
List of things to do as a part of their job. There will be no complaints because it is part of their job. The problem becomes when it is not part of their job and yet they are expected to spend time on it. There is where the conflict of priorities come. If I sit in any department.
00:21:04 Maria Ferres
And they said if you have obligation to report data breaches, you must ensure that ABC this is part.
00:21:10 Maria Ferres
Of your obligation adherence.
00:21:11 Maria Ferres
To the policy. Then, if I spend 30 minutes or a half a day dealing with the.
00:21:16 Maria Ferres
Data issue and.
00:21:17 Maria Ferres
My boss comes as what were you?
00:21:18 Maria Ferres
Doing for half the objective #2 I needed to do this.
00:21:22 Maria Ferres
Otherwise what happens is like ohh, just forget about that, continue with whatever else you are doing because that is.
00:21:27 Maria Ferres
Not part of our performance.
00:21:29 Dr Genevieve Hayes
I get it. So it really depends on how much the powers that be are backing all this, whether they take it seriously or if they're just.
00:21:37 Dr Genevieve Hayes
Paying lip service to it.
00:21:39 Maria Ferres
Indeed, if you cannot enforce the policies and the rules and the governments in.
00:21:45 Maria Ferres
The first line of defence.
00:21:47 Maria Ferres
You'll have to go home as the.
00:21:48 Maria Ferres
Chief State officer if you.
00:21:49 Maria Ferres
Can, if you're not empowered enough to enforce those without escalations to risk management compliance or other, then you are not sufficiently.
00:21:59 Maria Ferres
Cannot block people from doing the wrong thing, and the government is not about blocking people. It's about hearing what they want to.
00:22:06 Maria Ferres
Do and show them the right way to?
00:22:08 Dr Genevieve Hayes
So you've got these organisations that are a data mess where everyone's got their own little shadow, IT team going with their own little database and that's your point. A your chaos and your Nirvana state, that's where you've got good data, governor.
00:22:26 Dr Genevieve Hayes
It's you've got a single source of truth. Everyone knows their responsibilities under the data laws and the data policies of the organisation. So if that's your point, B, how do you get from point A to point B?
00:22:40 Maria Ferres
Some point A to point B would be to really spend time, and I encourage CEO's and upper management rather than just throwing this to one of their senior managers says, hey, it's your job to create a data function and deal with this because it's becoming a problem.
00:22:58 Maria Ferres
I think this is a conversation that needs to happen at the board level to decide what are we going to do to future proof the company for data risk. At the moment we have GDPR, we have digital Operational Resilience Act, we have data act, we have AI acts coming. We have Solvency 2, we have retention loans, we have ICT.
00:23:19 Maria Ferres
So my question is, what is the company doing to protect their future proof? Yes, you may have survived till now, but having a data function will not be optional in the future. The same way having a chief technology officer is no longer an optional thing.
00:23:36 Maria Ferres
And also just rather than it being forced.
00:23:39 Maria Ferres
On via regulation and being caught offside, saying ohh, you know we now need to comply.
00:23:44 Maria Ferres
Within the next two.
00:23:45 Maria Ferres
Years take time and think about what you're doing and how you can create the data. Assumption that supports your business strategy and supports your compliance.
00:23:57 Maria Ferres
Data functions were created in the 2008 or so of the back of the banking crisis.
00:24:04 Maria Ferres
And at that point, for insurance, it was kind of DIY, just manage your own data type of activity. But we are no longer in that point in time. We now have more and more increased regulation and we shouldn't only think of data as a defensive function to make sure compliance is there.
00:24:23 Maria Ferres
But it's also an offensive function because it has AI. It has advanced analytics, it has.
00:24:29 Maria Ferres
You know, machine learning it has all those amazing techniques and technology and skills that are coming into the market. So if you are going to want to take advantage of those, you need to have your data assumptions sorted out in advance. Otherwise you're not going to be able to. There is quite a lot of lovely means on on LinkedIn by people in a.
00:24:50 Maria Ferres
Mine who are struggling because the data is not managed to help them drive this forward. So my advice to all upper management will be sit down and have a calm sorrow conversation about what you.
00:25:05 Maria Ferres
Are going to.
00:25:05 Maria Ferres
Do with the.
00:25:06 Maria Ferres
Data. It is not something small. It is probably the most valuable.
00:25:11 Maria Ferres
Asset in the company.
00:25:12 Maria Ferres
And if it is your most valuable and you want to apply yourself on being data driven, then let actions speak. Take your time, plan and strategy of how you're going to implement.
00:25:24 Maria Ferres
Please be aware that it needs to be a top down exercise if the chief executive does not support this, it's not going to succeed.
00:25:31 Dr Genevieve Hayes
What sort of time frames are you talking about? Once someone does come up with a strategy in order to implement something like this?
00:25:38 Maria Ferres
Depending on the size of the company.
00:25:41 Maria Ferres
And jurisdictional expansion of.
00:25:44 Maria Ferres
Company for me a minimum.
00:25:46 Maria Ferres
Of two years.
00:25:47 Maria Ferres
To start putting things in place is needed. I think it is reasonable to expect after five years to start getting things to the point.
00:25:56 Maria Ferres
That you can start feeling.
00:25:58 Maria Ferres
A real impact in a day to day life of people on the ground now.
00:26:04 Maria Ferres
A lot of companies make a mistake of trying to do this as a side project, bringing in consultancy in who will give them a PowerPoint presentation with 30 things to develop. They go start checking the boxes and then they say you haven't see yourself to change.
00:26:20 Maria Ferres
This is about.
00:26:22 Maria Ferres
Outcome, not output.
00:26:24 Maria Ferres
And an external party can only do so much to bring an outcome to the broader company. They can do outputs. Here is a policy on this. Here is a recommendation for a.
00:26:36 Maria Ferres
Tool, but until you have embedded the.
00:26:39 Maria Ferres
Function you're not going.
00:26:41 Maria Ferres
To see value.
00:26:42 Maria Ferres
And by embedding the function I mean that the day-to-day activities of people on the ground is in line with the strategy that we have for the data it needs to be in the day to day activities of people.
00:26:57 Maria Ferres
Through communication training, enablement, management.
00:27:02 Maria Ferres
It needs all happen.
00:27:03 Maria Ferres
At the.
00:27:03 Maria Ferres
Same time it is.
00:27:04 Maria Ferres
Not a side project, it is.
00:27:07 Maria Ferres
A change management and culture change for the entire company.
00:27:12 Dr Genevieve Hayes
You keep mentioning you need to bring on everything at the same time, otherwise you're gonna have problems. So take it. You're talking about, you know, the data, governance, data management, et cetera. Would you also bring on the data analyst team at the same time or would you wait until you have all that data infrastructure set up before you?
00:27:31 Dr Genevieve Hayes
Bring on data analysts and data science.
00:27:33 Dr Genevieve Hayes
And to.
00:27:34 Maria Ferres
I think data scientists are probably not at the very start because those are the offensive functions. That is where the fruit of the word comes. I think the defensive ones will need to come at the same time with a small lag. The data scientists can come because once we start setting up the structure, we need to hear from the users. They are the ones.
00:27:55 Maria Ferres
Giving the requirements correct, we cannot develop data management.
00:27:59 Maria Ferres
In a vacuum.
00:28:01 Maria Ferres
So the requirements will come from analytics side. It comes from mibbi. It comes from data scientists. We need to know what they are doing so.
00:28:08 Maria Ferres
We can cater.
00:28:09 Maria Ferres
To them, this is what the data strategy is. A chapter in the business strategy.
00:28:14
You have a.
00:28:15 Maria Ferres
Business strategy and then you say my data strategy is doing this to support me, those people who develop data strategies.
00:28:23 Maria Ferres
Without reading their business strategy, they're just wasting their time. The point of the data function is basically to support the corporate vision. What is it you're trying to do? Depending on what you're trying to do, we may staff and resource different.
00:28:38 Maria Ferres
Lanes in the data function differently.
00:28:40 Maria Ferres
If you are thinking.
00:28:41 Maria Ferres
I want to go to market and collect data and off my marketing then I may.
00:28:46 Maria Ferres
Need more data protection?
00:28:47 Maria Ferres
People and you.
00:28:48 Maria Ferres
Know systems to collect information on behaviour if.
00:28:52 Maria Ferres
You say I like to go on a.
00:28:54 Maria Ferres
Cost reduction exercise because you know the market is tough, you're not.
00:28:57 Maria Ferres
Going to make sales.
00:28:58 Maria Ferres
Then I'm going to.
00:28:59 Maria Ferres
Boost up my retention and security and efficiency of data management to make sure we are not wasting money, that if you say are on intelligence on the competitors, I want to see how I benchmark.
00:29:11 Maria Ferres
Then I might bring over a different group of people. I might bring insight analytics and predictive modelling modellers, so I might gear my data function slightly differently, so it's very important that we hear about from the data centres. What is it they need? What can we prioritise?
00:29:27 Maria Ferres
Not all data is born the same, so we also they can direct us to data sources that are important to them so we can start putting guard rails on safe protect that those lines of.
00:29:39 Maria Ferres
Data. If you're not using database A, but everybody's using database in VB, then I'm going to put much more control over B I'm going to try to make sure it's secure that access control is actively managed, that they're engineers on a standby should it go down. So I will plan it differently.
00:29:56 Dr Genevieve Hayes
OK, so there was little as as necessary before you get the data scientists on and then hire them and proceed with them so that you can get their.
00:30:05 Maria Ferres
Yes indeed. We need to hear from the users, yes.
00:30:08 Dr Genevieve Hayes
One of these things I've seen happen in practise this was in the bad old days before organisations realised they needed to have data engineers, they'd have their IT team with their databases and then they'd hire their data analysts and data scientists and they wouldn't realise that they needed a data engineer in the middle and then the data scientists and data analysts would end up basically.
00:30:30 Dr Genevieve Hayes
Becoming data engineers in order to actually do their jobs, so I assume in your scenario you'd get.
00:30:39 Dr Genevieve Hayes
All the governance done first, then bring on the data engineers, then the data analysts and data scientists.
00:30:46 Maria Ferres
Yes, yes, because the requirements for how we do things comes from that, because there are the users of data in fact, why would I do anything I do with the data unless it was for the data scientists and data.
00:30:59 Maria Ferres
Analysts, I mean.
00:31:00 Maria Ferres
This is the reason the function.
00:31:02 Maria Ferres
Exists is to make.
00:31:03 Maria Ferres
Your lives easier, so we cannot.
00:31:06 Maria Ferres
Build this without hearing from you. This is a big problem in intro tech when they have live data. Quite a lot of data coming in and their structure is very.
00:31:14 Maria Ferres
Team, you need to be very precise to hear from. What is it you need that for? How long do you need it? Because this is live data, sometimes streaming for mobility activities and car insurance. You know, motor insurance tax. You need to talk about what you're capturing. And as you know, at the moment there is quite a lot of technology to work backward from anonymized data.
00:31:35 Maria Ferres
To identify people and intro text is is the data team is not there.
00:31:40 Maria Ferres
To hold their hands very early on.
00:31:43 Maria Ferres
They are going to.
00:31:43 Maria Ferres
Drown themselves in regulatory issues and this is one of the things that we discussed in when I talked to insure techs in this particular data topic. For example full driving, observing a driver for 90 days is sufficient to establish the risk of the driver the way they drive you, it's it's enough to establish the profile of.
00:32:04
Right.
00:32:04 Maria Ferres
So you don't.
00:32:05 Maria Ferres
Need to keep data more 90 days in that sense if you don't know this. If you're not asking the right questions from the actor is saying what is the latest? How long do they need to observe this person to be able to sign? You know, premium correctly to them. If they say 90 days, then the data team goes on, deletes the data after 90 days.
00:32:24 Maria Ferres
So we reduce the risk of the data person asking access to their data, asking for us to delete the data. We need to have capabilities to also delete data if someone reply.
00:32:34 Maria Ferres
If we are not there, having those conversations with the user, I can't decide autonomously as the data function. I'm gonna delete this after 90 days. The date has to come. The time frame has to come from the user. The data scientist saying I've gotten out of the data. What I need. I don't need it. Or can you must the data and anonymize it?
00:32:54 Maria Ferres
I need these three elements because I might need it for this purpose. Then we translate that into technical and data activities and then we execute if that conversation isn't there, there is a problem.
00:33:06 Dr Genevieve Hayes
That's one of the challenges you often face.
00:33:09 Dr Genevieve Hayes
Are there any other major challenges that you typically face when you're trying to implement these sorts of data transformations?
00:33:16 Maria Ferres
For me this the the points that I've mentioned are the core of it, the communication, the changing culture. I I in a very one of the clients I had, I actually said the following I said I'm not bringing you new data and I'm not changing your data source.
00:33:32 Maria Ferres
What I am bringing is I'm.
00:33:34 Maria Ferres
Changing the way you.
00:33:36 Maria Ferres
Interact with data, so this is what I'm bringing because you say you're the head of data, yes.
00:33:42 Maria Ferres
But I'm not.
00:33:43 Maria Ferres
You know, it's not like I I come with a with a good bag of nice Peter. Here you have it. That's not my job.
00:33:49 Maria Ferres
What I am changing?
00:33:50 Maria Ferres
Is human behaviour.
00:33:52 Maria Ferres
And because this is considered a major change in the organisation, company must be ready for change. Readiness is a key point.
00:34:02 Maria Ferres
I have had.
00:34:03 Maria Ferres
Clients whereby one group is trying to implement the data assumption. This C4 has other priorities and doesn't wanna hear about.
00:34:10 Maria Ferres
It there is a.
00:34:12 Maria Ferres
And I cannot as.
00:34:14 Maria Ferres
A head of data sitting in another.
00:34:16 Maria Ferres
Vertical force the hand of the CFO. I can't.
00:34:20 Maria Ferres
I am not at.
00:34:21 Maria Ferres
The level in the organisation where.
00:34:23 Maria Ferres
I can say to the CFO wait a minute.
00:34:25 Maria Ferres
You can't just.
00:34:26 Maria Ferres
Duplicate the entire database, put it somewhere else, and do something else.
00:34:32 Maria Ferres
Do it if I.
00:34:34 Maria Ferres
Cannot, as a head of data, stop.
00:34:36 Maria Ferres
That from happening and negotiate a better way.
00:34:39 Maria Ferres
Then I'm not.
00:34:40 Maria Ferres
In power. So this is the key that.
00:34:43 Maria Ferres
I need to be able to as someone heading the function to talk to my peers about the treatment of data. They would say this is.
00:34:51 Maria Ferres
We need. How do we go?
00:34:53 Maria Ferres
About it, then a few questions.
00:34:55 Maria Ferres
Will be asked, and maybe there's.
00:34:57 Maria Ferres
Better way to go about it because.
00:34:59 Maria Ferres
Business giving IT requirements is a very, very dangerous thing sometime.
00:35:03 Dr Genevieve Hayes
So are we talking bottom up or top down, so CFO level or?
00:35:07 Maria Ferres
I think when requirements comes from the business often.
00:35:13 Maria Ferres
It here is something different thinking tools and capabilities. Whereas business asking for a solution, but because they don't speak the same language, often they end up something that is not quite giving them the output they ask, but not.
00:35:29 Maria Ferres
The outcome they are.
00:35:30 Maria Ferres
And I'll remember.
00:35:31 Maria Ferres
Taking requirements of wine back and I asked the finance team tell me your requirements and it went something like this. Imagine in a house there is a fridge, the lighting, it is broken, it's leaking a bit and the temperature is not as steady. And I asked them what are your.
00:35:50 Maria Ferres
Parents, the answer was we want the light to work and it's best if it doesn't leak or smell. This is not a requirement. The requirement will be we would like a fridge that has this capacity, this temperature and this performance. But they were so suffering with problems that it took.
00:36:10 Maria Ferres
Many meetings to actually tease out the true requirements now.
00:36:15 Maria Ferres
To take tease out those requirements is not within IT capabilities, nor it's their job to tell the finance team. But what do you really want? Oh, I want to have this, but what do you need it for? Oh, I need it because I need to match it to this data set to bring this. So you just want to make sure these two.
00:36:35 Maria Ferres
Break themselves is.
00:36:36 Maria Ferres
Something that might be able to be done.
00:36:37 Maria Ferres
In the back end, you.
00:36:38 Maria Ferres
Know you don't need to do that.
00:36:40 Maria Ferres
So that conversation there needs to be someone to facilitate.
00:36:46 Maria Ferres
It and make it.
00:36:47 Maria Ferres
Happen once that true requirements become clear, then you go to IT saying I need the you know database that has these capabilities. The auditability this speed, the capacity, you know, the so then you can translate those into technical.
00:37:01 Maria Ferres
This IT and business talking together is I have never seen.
00:37:06 Maria Ferres
It go well.
00:37:07 Dr Genevieve Hayes
Let's start with the results you want, and then choose the best tool to achieve that result rather than starting with the tool and then trying to get the result you want from that tool.
00:37:17 Maria Ferres
Indeed. And I think IT should be within.
00:37:20 Maria Ferres
The limit to choose the technical capabilities as.
00:37:24 Maria Ferres
Long as.
00:37:25 Maria Ferres
It is the outcome, the.
00:37:26 Maria Ferres
Problem is, business doesn't give good requirements.
00:37:29 Maria Ferres
It chooses a tool.
00:37:31 Maria Ferres
Business is not this one. I want the other one and.
00:37:34 Maria Ferres
That is as well. It's not up to you.
00:37:35 Maria Ferres
To choose the two so there.
00:37:37 Maria Ferres
Becomes the problem and I've seen time and time again because they are not asked for the outcome. Business has tried to solutionize what would solve their problem because business by nature their.
00:37:50 Maria Ferres
Problems and they have been left to fend themselves for a very long time without the data. So as an actuary I wanna tell IT. Give me this tool, I will fix the rest myself. Just get me this. I'll take it the rest of the way. Because business.
00:38:08 Maria Ferres
Doesn't want to.
00:38:08 Maria Ferres
Give up right. And you want to hold.
00:38:10 Maria Ferres
Data because this is what an actually does by nature for data and try to solve your own problems and the IT is giving you what you're asking for. But then you say, well, what happens when the data is updated? Well it deletes and puts the new data in. No, this is not what I wanted. I need to cut traceability. Well that was not one of your requirements.
00:38:29 Maria Ferres
Was it because nobody asked that specific question? Someone with the content knowledge to ask? How do you refresh this? Because certain columns are monthly, some are daily. What what CAP data capture you want. So those conversations are very interesting to watch and one of them was that one of the companies I worked for, they brought me in.
00:38:49 Maria Ferres
Specifically to stop it and business to.
00:38:52 Maria Ferres
They basically told me make sure actuaries and it don't talk without you in that meeting. The problem was that they were trying to use the resulting platform and it didn't understand that the claims need to go in a triangle. It's natural for it not to go in a triangle, right? I couldn't understand. They kept giving requirements.
00:39:12 Maria Ferres
And because they never thought of the triangle, they kept trying to square it somewhere, and they kept coding.
00:39:19 Maria Ferres
The actors would test and it.
00:39:21 Maria Ferres
Would be wrong.
00:39:22 Maria Ferres
And again and again and again.
00:39:24 Maria Ferres
It wasn't till I arrived and I said this is what we are trying to do.
00:39:27 Maria Ferres
We are trying.
00:39:28 Maria Ferres
To get to the end of it, the last column, that ultimate, that is what we are trying to look for. So what I need you not to do is to think in terms of a diagonal. So then they're like.
00:39:39 Maria Ferres
What this explains?
00:39:40 Maria Ferres
All those weird.
00:39:41 Maria Ferres
Codes that we've been reading because actually.
00:39:43 Maria Ferres
Code and these codes I I read the in reinsurance SAS code it was about 200 pages and about 30 different people since then like 90s have been writing this.
00:39:53 Maria Ferres
Code each of them.
00:39:54 Maria Ferres
Literally, when you netted out the the repeated activities, that was like half of it was deleted. So the IT needed to read this.
00:40:03 Maria Ferres
And understand what their business is trying to achieve.
00:40:06 Maria Ferres
It's not an easy thing.
00:40:08 Maria Ferres
When you're thinking of a reserving process, right there lies the problem that there is the data function clearly missing to kind of translate to the data architects, the data engineers, the enterprise architecture, how this needs.
00:40:22
To go.
00:40:23 Dr Genevieve Hayes
And given your actuarial background, I'm sure you would be very popular in the role that you're in because you can actually speak data nerd and actuary.
00:40:32 Maria Ferres
Indeed. And and actually that and.
00:40:34 Maria Ferres
Says no, no, but but.
00:40:35 Maria Ferres
But, but we need this for this and and I know that they don't. They just want it. They don't need it. They want it because they.
00:40:42 Maria Ferres
Want to exert?
00:40:42 Maria Ferres
Control over the process.
00:40:44 Maria Ferres
However, they may be easier for them to relinquish power, knowing that on the other side in the data there is an actually managing the data.
00:40:53 Maria Ferres
Portion of the activities so there there are a.
00:40:55 Maria Ferres
Lot more willing to to talk and willing to to speak.
00:41:00 Maria Ferres
And their terms, I have to say no to them. Or can we put this over here? We like it in this database. We want to put it in this drive, you know, this is part of the critical process. You cannot put it somewhere where we can't back it up live, you know? So I I have to sometimes explain to them why things can't be done because actually is always done what they want because the company empowers.
00:41:20 Maria Ferres
To do so, but when you need to govern, they need to relinquish some of their powers in exchange for better service. Right. And that needs to be negotiated clearly with the actuarial team.
00:41:33 Dr Genevieve Hayes
Yeah, I can imagine you'd have some people who had built a data empire for themselves that would be clinging.
00:41:39 Dr Genevieve Hayes
On with their fingernails digging in and stuff like that.
00:41:44 Maria Ferres
And and I.
00:41:44 Maria Ferres
Had jokingly said in the team with actresses don't lie to me. Guns. You're hiding something somewhere.
00:41:49 Maria Ferres
I I know.
00:41:49 Maria Ferres
It come on.
00:41:50 Maria Ferres
Tell me where where those these drives are.
00:41:52 Maria Ferres
Because I need.
00:41:53 Maria Ferres
I need to bring them into the new network so we can we can clearly keep auditability, et cetera. And they're laughing because.
00:42:00 Maria Ferres
I can. I can see that they're they're holding more.
00:42:02 Maria Ferres
Data because I would.
00:42:05 Dr Genevieve Hayes
Sort of reminds me of the kids who were smoking behind the gym in high school.
00:42:10 Maria Ferres
It is exactly that.
00:42:11
You can kind of like, oh, come on.
00:42:12 Maria Ferres
Boys, I know you have more. This is not.
00:42:15 Maria Ferres
Everything come on.
00:42:16 Maria Ferres
And they're they're.
00:42:17 Maria Ferres
Much more.
00:42:18 Maria Ferres
It is true.
00:42:19 Dr Genevieve Hayes
With all your issues with data governance and data management, do you have issues with bringing in open source tools like Python And R to work with that data?
00:42:29 Dr Genevieve Hayes
Because that's an issue that I know some organisations struggle with.
00:42:34 Maria Ferres
We haven't had.
00:42:35 Maria Ferres
Any. Yeah, I think every, every client have had the access they have are deployed and they have 500. That's.
00:42:42 Maria Ferres
The most commonly used to.
00:42:44 Dr Genevieve Hayes
OK, that's good. Because I remember in one organisation this was quite a while back. You know they would not look at open source tools and then?
00:42:53 Dr Genevieve Hayes
As things progressed, organisations were looking at open source tools, but they wouldn't allow the data scientists to import their own packages, so the tools were useless. So it sounds like.
00:43:02 Dr Genevieve Hayes
Actually progressing those.
00:43:04 Maria Ferres
And I think they.
00:43:05 Maria Ferres
Have progressed and and to be on the some of the actuarial software is not very friendly. For example, I think a lot of actuarial teams could use better reserving tool.
00:43:15
And I will not.
00:43:16 Maria Ferres
Name there are some older tools that are dominating the market that are not very friendly. They don't lend themselves into proper order trails because things need to be imported and imported continuously. They cannot auto feed it. I see part of my function is helping because actually.
00:43:35 Maria Ferres
Lost and scared to proprietary, saying can we see if we have a better reserving tool or a better tool of such because they they kind of don't trust that IT understands their requirements.
00:43:45
And I think.
00:43:46 Maria Ferres
Actually should feel comfortable looking for better tools that allows an automated activity because we also have quite a lot of end user application developed by actuaries, a lot of complex macros, a lot of and I think they are currently tools that facilitate those but I think.
00:44:07 Maria Ferres
Factories are potentially too frightened to to change this structure that is built, but we do need to get.
00:44:15 Maria Ferres
Rid of end.
00:44:16 Maria Ferres
User computing because as much as we.
00:44:18 Maria Ferres
Can because they.
00:44:19 Maria Ferres
To pose quite a lot of risk to the organisation data audit the the lineage of the data breaks the the code.
00:44:27 Maria Ferres
You know, can you need to?
00:44:29 Maria Ferres
Keep it secure you need.
00:44:30 Maria Ferres
To have backups of it and all sorts of things are required by the auditors in terms of the end user competing. So I think that could also help.
00:44:39 Maria Ferres
The actuaries to kind of turn the page into new tools for actual work.
00:44:45 Dr Genevieve Hayes
Even though I'm recording this episode from.
00:44:48 Dr Genevieve Hayes
Well, yeah. Maria, you're calling in from the Pyrenees between France and Spain, and that's in the EU, which means you've got to deal with the GDPR data laws in your work. Now, you've already talked about having to potentially delete data if you're required to. I assume that's a.
00:45:09 Dr Genevieve Hayes
GDPR requirement? Are there any other ways in which the GDPR impacts your?
00:45:15 Maria Ferres
GDR impacts are working every way because we need to build our processes with privacy in mind. It's called privacy by design. Will also need to be aware that individuals may have the right to amend, to delete and access their data. So when we create a process that needs to be kept in mind.
00:45:35 Maria Ferres
If I cannot isolate and delete a record on request, if I cannot provide a search.
00:45:41 Maria Ferres
The person can access their personal.
00:45:43 Maria Ferres
Data. Then we have a problem because.
00:45:45 Maria Ferres
We need to.
00:45:45 Maria Ferres
Be compliant with GDPR.
00:45:47 Maria Ferres
This is a topic that I also say GDPR is not a compliance topic. It is also a compliance topic, but it is really a data topic because just besides the personal data, which is really important, we also have commercially.
00:46:01 Maria Ferres
Sensitive data.
00:46:02 Maria Ferres
And that we?
00:46:03 Maria Ferres
Need to protect and that is something that is not currently governed by any legislation because it's really in the eyes of the beholder. So from the data security perspective, I have the personal data which is regulated, and then there is a commercially sensitive data that we kind of write the rules for in the company. GDPR is important.
00:46:23 Maria Ferres
Also, in terms of data transfer and in terms of data incident management, the biggest incidents comes from processes of yours of processes.
00:46:33 Maria Ferres
So, and let's just say I need to process this data we have given it to this company to do OK. And what are they doing because my obligations don't end when you hand it over the client data to 3rd party. So I need to know what the third party is doing. So the remits of the data function expands.
00:46:54 Maria Ferres
Where the data of the company goes if the data of the company goes to 60 different countries, I need to keep an eye on all sixty countries and everyone who processes the data.
00:47:05 Maria Ferres
And can the data transfer out of EU? Sometimes the answer is no, and if I give it to a payroll company, let's say in London, and then they have a sub processor in India.
00:47:15 Maria Ferres
Now they all.
00:47:15 Maria Ferres
Have two problems GDPR UK.
00:47:18 Maria Ferres
Because they're out of EU. And then?
00:47:20 Maria Ferres
India has its own privacy laws, so I need to.
00:47:22 Maria Ferres
Keep an eye on.
00:47:23 Maria Ferres
How our data subjects are impacted by that transfer, so GDPR is not just eating the data, but where does the data go? Now imagine in India they have a data incident because they've been hacked. Now the problem begins where it could.
00:47:37 Maria Ferres
On which data? Sir, I need to be able to identify the data of the people who have been breached and I may need to notify them individually. It is quite a big mindset shift that I actually am accountable. The company is accountable to to the individual and we need to answer to them. There are.
00:47:57 Maria Ferres
Quite a lot of court cases going on. It's a emerging area of litigation. So I need to keep up to date with all the court cases and all the rulings, especially within.
00:48:09 Maria Ferres
You and the data protection Officer is is an excellent source of knowledge on those topics for each company, the data protection assessor is a is a regulated role and the persons are named person with the data protection authorities. Their job is to advocate for the data subject. If there is a breach or an incident.
00:48:30 Maria Ferres
The Data Protection officer needs to.
00:48:31 Maria Ferres
Be notified we need to.
00:48:33 Maria Ferres
Decide if the regulator is going.
00:48:34 Maria Ferres
To have to be notified if the people.
00:48:35 Maria Ferres
Are notified we need to establish.
00:48:37 Maria Ferres
The level of risk, so this is quite a lot of work.
00:48:41 Maria Ferres
People may not think.
00:48:42 Maria Ferres
So, but typically the data function must review every contractual agreement the company gets into to make sure if there is a data transfer within it, you may not think so, but something as simple as a catering company. But people's allergies are listed. That is something that falls within the limit of the data function we need to make sure that because that is health.
00:49:03 Maria Ferres
But, you know, restricted health data.
00:49:05 Dr Genevieve Hayes
With the data deletion laws, if you are required to delete a data point which had been used to train some sort of machine learning.
00:49:15 Dr Genevieve Hayes
Model what would happen then? Would you have to retrain the model without that data point or could you keep using that trained model?
00:49:23 Maria Ferres
It depends on what information is used. If the person wants the data deleted, we need to delete the data and there need to be no way to walk backward to that person's identity from any other captured data capture.
00:49:36 Maria Ferres
And this does not.
00:49:37 Maria Ferres
Mean we need to remove them from.
00:49:39 Maria Ferres
Aggregated data. So if we've added income.
00:49:42 Maria Ferres
Of a neighbourhood.
00:49:44 Maria Ferres
And one person removes themselves. They don't need to.
00:49:46 Maria Ferres
Go and the aggregate.
00:49:47 Maria Ferres
It because once we remove the person.
00:49:49 Maria Ferres
Files the rest of the the the conclusions can remain because from the conclusions you can't walk, you know, work your way back to the person and this is something we really need to be careful about because technology now allows us to cross reference multiple sources and sometimes even you think you've deleted and removed.
00:50:10 Maria Ferres
You can make your way back.
00:50:12 Maria Ferres
To the individual again so that this is something that we.
00:50:14 Maria Ferres
Need to be.
00:50:15 Dr Genevieve Hayes
You have heard with GitHub copilot.
00:50:18 Dr Genevieve Hayes
So that was trained on all this code that was sourced from GitHub, and some people have managed to actually go backwards to specific pieces of code that they actually wrote.
00:50:28 Maria Ferres
Yeah, this this is what?
00:50:30 Maria Ferres
I mean, it is not just a compliance topic you cannot expect, let's say someone who is a lawyer to understand the intricacies of technology to to ensure that we we need the translator between the regulation point to the technical implementation, there needs to be a lot of work done.
00:50:49 Maria Ferres
To tease out.
00:50:50 Maria Ferres
Where the weaknesses are and as there was, there was someone talking about the device that people need.
00:50:56 Maria Ferres
To track exercise and even though the company had anonymized the data once they captured data from open sources, they could work backward to the individuals home address. So these these are the things even as a company, you think you've done.
00:51:11 Maria Ferres
Your part you've really not done it because technology is evolving so fast that we can't barely keep up.
00:51:18 Maria Ferres
So there needs.
00:51:18 Maria Ferres
To be someone on the technology side who's savvy enough to point these things out.
00:51:24 Maria Ferres
These may be things that.
00:51:26
If you just read the.
00:51:26 Maria Ferres
Regulation you may not think.
00:51:28 Maria Ferres
To look at, but there needs to be a connection between the regulation, strict wording of the regulation and very nitty gritty, challenging technological.
00:51:37 Maria Ferres
Aspects of it.
00:51:38 Dr Genevieve Hayes
Is there anything on your radar in the AI data and analytics space that you think is going to become important in the next three to five year?
00:51:47 Maria Ferres
Yeah, AI is quite an interesting one because all the companies are not talking about AI and what goes into AI's data and what comes out is data. So it directly impacts the data function per say and also the other topic within the insurance.
00:52:07 Maria Ferres
That there is the.
00:52:07 Maria Ferres
Companies need to make a determination.
00:52:09 Maria Ferres
Where they stand on a it's not a.
00:52:11 Maria Ferres
Ring you know a.
00:52:12 Maria Ferres
Bell that you can unring so there needs to be very clear risk assessments.
00:52:19 Maria Ferres
Of the risk.
00:52:19 Maria Ferres
Of AI and ethical use of IT management of it, the human controls so and the AI act is coming by the.
00:52:28 Maria Ferres
End of the year in.
00:52:29 Maria Ferres
EU and if you deploy AI in a multi jurisdictional company, you may be subjected to that many regulations. So I.
00:52:39 Maria Ferres
Think managing that alone will require quite.
00:52:42 Maria Ferres
A lot of.
00:52:42 Maria Ferres
Asset now this is strictly from the compliance perspective, however if.
00:52:48 Maria Ferres
You put tools.
00:52:49 Maria Ferres
1st and you design a tool without thinking of a potential compliance as.
00:52:55 Maria Ferres
Effects you may put yourselves at the peril of not being able to contain the activities that are happening so.
00:53:02 Maria Ferres
I think that the.
00:53:03 Maria Ferres
Next phase would be for companies to clearly understand the.
00:53:07 Maria Ferres
And do a.
00:53:07 Maria Ferres
Risk assessment on AI then decide on their AI a.
00:53:11 Maria Ferres
Strategy because if you put the tool first.
00:53:14 Maria Ferres
And then think second.
00:53:16 Maria Ferres
The implications of it you may find yourselves in a situation with the ChatGPT. For example. A lot of companies people have copied and pasted data into their chat.
00:53:29 Maria Ferres
Training very confidential information. Imagine if you are drafting an email to the regulator and you think, oh, I can't quite understand how to phrase this last paragraph. Let me stick all of this into chat, GT and and exactly these are all dear moments for me when I hear of these things.
00:53:49 Maria Ferres
And you think, OK, I'd love to chat, GPD, but there are another, maybe 30-40 other ways to get around that. We have to keep up with the technology because they're they're running while we are kind of slowly crawling in the data function. So this is where the risk.
00:54:04 Maria Ferres
Is between the.
00:54:06 Maria Ferres
Running and a group that are crawling.
00:54:09 Dr Genevieve Hayes
The the other one I heard the other day was. No no, I'm not using chat chipita you don't have to worry. I'm using Google. Bad. We. Yeah, same thing. It's like, yeah, that makes all the difference. No.
00:54:23 Maria Ferres
Exactly. Exactly. And.
00:54:25 Maria Ferres
I have more and.
00:54:26 Maria Ferres
More projects needing consultation because we need to.
00:54:29 Maria Ferres
And financial reports, because they come in hard copy or the underwriters need something keeping up with tech.
00:54:36 Maria Ferres
Analogy. It is hard because they are very creative and they're amazing tools out there. However, I'd like to see a point where the data function can keep up. In most companies we are at the point of master data. Do we need one or not? Whereas technology is going on a.
00:54:57 Maria Ferres
High speed down the highway and this is where I see the risk that technology is going to put companies in peril without them realising it.
00:55:06 Dr Genevieve Hayes
Well, I remember, you know, a few years back I was working with an organisation that had started on.
00:55:12 Dr Genevieve Hayes
They Hadoop data platform when that was the right thing to do, and by the time they'd finished building it, no one wanted to do data platforms anymore. Everyone had started moving to the cloud, so then they had to start moving to the cloud.
00:55:29 Maria Ferres
Yeah, I actually.
00:55:30 Maria Ferres
Gave a very similar example. You know in Pink Panther one is painting pink around the column and one blue. Sometimes in the companies I see project.
00:55:37 Dr Genevieve Hayes
Oh yeah.
00:55:40 Maria Ferres
Whereby one is saying we are going to completely move ourselves out of this platform into the other one. Meanwhile, the IT department is buying.
00:55:51 Maria Ferres
More capabilities for the platform that.
00:55:53 Maria Ferres
The rest of.
00:55:53 Maria Ferres
The business is trying to abandon because there's no coordination on the topics sometimes.
00:56:00 Maria Ferres
When the companies don't have a good communication, it can be that Group A is building something, whereas Group B is completely changing direction.
00:56:10 Maria Ferres
It is very hard for people to understand the immense limit of the data. It's always in the places you don't think in a given day. The topics that I deal with, and this is part of the challenging part of the managing the data. So I could be in a meeting discussing a code and AI technology.
00:56:30 Maria Ferres
Next meeting I could be on a topic to do with the clause in a contract because the data is transferring somewhere else and the next minute in a risk management meeting in terms of regulatory solvency too, requires ABC. How do we so the the the discipline?
00:56:48 Maria Ferres
Disciplines that are involved in running.
00:56:50 Maria Ferres
A data function are quite quite well.
00:56:52 Maria Ferres
So you need.
00:56:53 Maria Ferres
To really understanding of many many topics and things and that is very challenging even for me, and I've worked almost.
00:57:01 Maria Ferres
In every department in an insurance company.
00:57:03 Maria Ferres
And and I find.
00:57:04 Maria Ferres
It quite challenging.
00:57:05 Maria Ferres
Because then you you.
00:57:06 Maria Ferres
You you have.
00:57:07 Maria Ferres
A data incident and you're in a team with.
00:57:09 Maria Ferres
A team of security engineers and network controls and and firewalls. And they need you to make decisions on topics, so you need to kind of keep yourself up to.
00:57:20 Maria Ferres
It with with quite a lot and and it's it's very, very difficult.
00:57:25 Dr Genevieve Hayes
What final advice would you give to data scientists looking to create business value from data?
00:57:31 Maria Ferres
The best advice?
00:57:32 Maria Ferres
I could give is if your organisation does not have a data function inform yourselves and on the topic of data management and try to see if.
00:57:43 Maria Ferres
While you are.
00:57:44 Maria Ferres
Not supported by the data assumption because it may not exist. If you can manage yourself so that down the track you don't have further difficulties because of the form of data. So try to.
00:57:57 Maria Ferres
At least self govern is my advice.
00:58:00 Maria Ferres
Try to work in a.
00:58:02 Maria Ferres
Clear structured.
00:58:03 Maria Ferres
Governed manner documented in a way that is understandable sometimes when I am onboarding the data assumption if I see a particular unit very governed and very structured.
00:58:15 Maria Ferres
I don't try to.
00:58:17 Maria Ferres
Bring them into alignment with the enterprise. I try to say don't governed in US, I will educate myself on their governing the structure rather than forcing them to align to the enterprise because I think they have quite a lot of good processes and I can just allow that to continue with that.
00:58:35 Maria Ferres
Using their more enterprise mind structure on them.
00:58:38 Maria Ferres
So it does help.
00:58:40 Maria Ferres
I I have.
00:58:41 Maria Ferres
The with many clients they they run really meticulous teams. Some of the units underwriting, sometimes they're just impressively organised and structured.
00:58:51 Maria Ferres
Within their little.
00:58:51 Maria Ferres
Bubble. They have very well governed structures and that's really excellent. It helps.
00:58:57 Dr Genevieve Hayes
So act as though the governance is actually there.
00:59:00 Maria Ferres
Or actually have.
00:59:01 Maria Ferres
A discussion on it saying how are we?
00:59:03 Maria Ferres
Going to govern?
00:59:04 Maria Ferres
You know this?
00:59:05 Maria Ferres
Piece. You know, definitions are kept here. Who's responsible for it? Who is keeping track of the the code governance. You. You can work in a structured way and and that that does help in the long run.
00:59:18 Dr Genevieve Hayes
So for listeners who want to learn more about you or get in contact, what can they do?
00:59:23 Maria Ferres
I'm on LinkedIn. You can definitely reach out if you're in senior management or board or CEO and you think yes, we could use a thinking partner. Feel free to reach out if you're interested.
00:59:34 Maria Ferres
In the data function and.
00:59:36 Maria Ferres
Want to work in one?
00:59:38 Maria Ferres
Drop me.
00:59:38 Maria Ferres
A note if.
00:59:39 Maria Ferres
You have any questions?
00:59:40 Maria Ferres
Or you have any comments about that the podcast?
00:59:44 Dr Genevieve Hayes
Thank you for joining me today, Maria.
00:59:46 Maria Ferres
Thank you very much for having me.
00:59:48 Dr Genevieve Hayes
And for those in the audience, thank you for listening.
00:59:51 Dr Genevieve Hayes
I'm doctor Genevieve Hayes and this has been value driven data science brought to you by Genevieve Hayes Consulting.