New framework launched to boost trust in data sharing among companies

SINGAPORE — In a future world crazy about data, hospitals may soon sell anonymised patient information to pharma companies, ride-hailing firms may sell their drivers' behavioural data to insurance businesses and telcos may trade their customers' location data with mall operators.

While such data sharing arrangements are already legally possible today and have been planned for some time now, they have perplexed companies on the right price and method to trade sensitive customer data, which can also contain business secrets.

In order for such data to be shared responsibly and in an accountable way, the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC) released a new framework on Friday (June 28) to guide companies when they trade consumer data with each other.

Mr Lam Chee Kin, DBS Bank's managing director and head of group legal, compliance and secretariat, said being in a Smart Nation is no longer about each institution working on its own data.

"It’s hard to know how to excel in sharing data broadly yet preserve the trust of your customers and business partners — for example, how you share operationally, how you secure the infrastructure, and how you value it. So this framework levels the playing field for everyone in establishing a baseline common language,” said Mr Lam.

CHALLENGES OF DATA SHARING

Can a company’s sensitive data be shared through e-mail? Should a company share confidential customer data and risk reputational damage if the other party ends up leaking such information?

These questions have plagued Singapore’s fast growing Internet economy, which is set to surge from S$7 billion in 2015 to S$22 billion in 2025. One report by consultancy firm McKinsey said an open data economy can unlock US$3 trillion to US$5 trillion (S$4.1 trillion to S$6.8 trillion) in economic value globally each year.

But IMDA said firms today face five main challenges that inhibit how data assets can be shared and traded among each other:

1. There is a lack of guidance, methodology and systemic approach for data sharing;

2. There is a need to build trust between business partners before they may share such information;

3. Companies must adhere to regulations, such as the Personal Data Protection Act;

4. There is a difficulty in valuing the data assets they have;

5. There is a fear that data sharing could result in a loss of business competitiveness, or expose trade secrets to the competition.

Speaking to TODAY, Ms Lynn Thompson, general manager of Data Republic Singapore, said companies recognise that sharing of data reaps multiple benefits, whether it is between teams, subsidiaries or with external business partners. Data Republic is a data exchange startup whose investors include Singtel and Singapore Airlines.

“The reality is that data sharing is difficult,” said Ms Thompson. Project and legal negotiations are time consuming and not secure, with a lack of clarity in workflow and how both sides can agree to a mutual licence between parties.

There is also no clear means of auditing how such data is used, she added. “Things can get complicated quickly, so very few companies are able to execute and scale data collaborations in a meaningful way.”

WHAT THE FRAMEWORK SETS OUT

To address these problems, the Government launched a 91-page framework to help these businesses get their data sharing agreements off the ground.

The framework will:

• Provide a common “data sharing language”, with various strategies and models on how data can be shared between two parties

• Establish how personal data can be anonymised and transmitted between partners

• Provide a guide through regulatory considerations and the contractual, technical and operational safeguards needed

• Highlight processes for how shared data is handled, used and disposed, to ensure transparency and accountability of the data exchange

The cornerstone of these arrangements is the trust that companies place on other businesses, as well as whether customers trust businesses with their personal data, said data industry players and analysts speaking to TODAY. But without such a rulebook to follow previously, it is difficult for trust to exist, they said.

On Wednesday, Prime Minister Lee Hsien Loong also highlighted that trust in the digital economy is key for Singapore to reach its Smart Nation goals.

“People need to understand the risks of technology, whether on cyber security, privacy, or online falsehoods… But we people must not be anti-tech or anti-science, because that would hold back progress and be the end of us,” he said.

Ms Thomson said the framework “delivers clear, accessible guidelines for Singaporean companies who are looking to participate in the data economy”, as well as to prepare them for the risks involved.

“The framework provides a best-practice methodology for how to approach potential data collaborations. This is important to help overcome uncertainty on where and how to start to unlock value from data,” she said.

EXAMPLES OF DATA SHARING

1. A third-party property service provider, such as a web portal, can receive valuation data from multiple real estate companies and property firms. Aggregating such data can provide a real-time, comprehensive view of property market valuations, which can benefit the real estate industry as well as home buyers.

2. Supply chain management firms can share real-time data of delivery routes with a manufacturer, who can then see how their inventory is moving around the world. It also allows the manufacturer to crunch the data and optimise its manufacturing processes, as well as to prevent unnecessary stocking of slow-moving or soon-expiring stock across warehouses.

3. Telcos can share location data of its customers with retailers, who can then use the information to curate its products and analyse shopper traffic in their shops. In return, retailers can share their customers’ interests and preferences with telcos, who can use these customer insights to develop new products and services.