There are some people who believe that all data is meant to be analyzed. These people are the same ones that GDPR and the new California Consumer Privacy Act (CCPA) were put in place to rein in. Analysis can yield deep insights into consumer and employee behavior. But this insight can be a very double-edged sword.
Let’s use the systems used to secure our buildings as an example. Cameras, badge data, log-in credentials, and visitor registrations are minimal requirements most of the time to ensure there is a safe and controlled environment for business to operate in. This data is a requirement to be collected but certainly not required to be analyzed for anything outside of security standards.
Yet, this data could also be considered extremely valuable to some businesses or 3rd parties. Some businesses see this data as a way of doing deeper analysis on employee behaviors – What time are they coming in? What kind of attire are they wearing? Who steps out for smoke breaks? Who is arriving with who? When do people change behavior? It doesn’t take long for these questions to get deep into the personal life of employees.
Landlords get different value from this data. They could provide the video to 3rd parties to train facial recognition systems. They could provide their data to potential vendors to plan amenities (coffee, supplies, etc.). They could use visitor registration to try and predict business events based on visitor patterns. This data could be used to further monetize their tenants in ways possibly against those tenants’ interests. Yet very few leases deal with the tenant’s rights around that data. The biggest problem around data analysis is that it can too easily be used in new and unexpected ways by parties that were never originally a party to the data.
With that background, here are 3 questions to answer to determine if you should perform data analysis on your data (notwithstanding any laws or regulations that direct differently):
- Will this data analysis support improved business operations for the company that collected the data?
- Is the data unrelated to individual employees or customers?
- Is the data being used in a way that is related to why it was originally collected?
If you are able to answer yes to all of these questions, go forth and analyze.
If you answered no to any of these, it is worth stopping and questioning why you need to perform the analysis. If you aren’t improving business operations for the company that collected the data, then the intent is unknown or for another company entirely. If the data targets individual customers or employees, there are entire swaths of HR and government professionals that could find problems with what you are doing. If the data is being used in an unexpected way, there could have been statements to others that described the intent which prevent or minimize unintended uses.