2018 Predictive Analytics Symposium Session 26: Industry Best Practices for Data Protection

Transcription

1 2018 Predictive Analytics Symposium Session 26: Industry Best Practices for Data Protection SOA Antitrust Compliance Guidelines SOA Presentation Disclaimer

2 Industry Best Practices for Data Protection Brad Lipic Vice President, Head of Data Strategy Global Research and Data Analytics (GRDA) September 20, 2018

3 SOA Antitrust Compliance Guidelines Active participation in the Society of Actuaries is an important aspect of membership. While the positive contributions of professional societies and associations are well-recognized and encouraged, association activities are vulnerable to close antitrust scrutiny. By their very nature, associations bring together industry competitors and other market participants. The United States antitrust laws aim to protect consumers by preserving the free economy and prohibiting anti-competitive business practices; they promote competition. There are both state and federal antitrust laws, although state antitrust laws closely follow federal law. The Sherman Act, is the primary U.S. antitrust law pertaining to association activities. The Sherman Act prohibits every contract, combination or conspiracy that places an unreasonable restraint on trade. There are, however, some activities that are illegal under all circumstances, such as price fixing, market allocation and collusive bidding. There is no safe harbor under the antitrust law for professional association activities. Therefore, association meeting participants should refrain from discussing any activity that could potentially be construed as having an anti-competitive effect. Discussions relating to product or service pricing, market allocations, membership restrictions, product standardization or other conditions on trade could arguably be perceived as a restraint on trade and may expose the SOA and its members to antitrust enforcement procedures. While participating in all SOA in person meetings, webinars, teleconferences or side discussions, you should avoid discussing competitively sensitive information with competitors and follow these guidelines: -Do not discuss prices for services or products or anything else that might affect prices -Do not discuss what you or other entities plan to do in a particular geographic or product markets or with particular customers. -Do not speak on behalf of the SOA or any of its committees unless specifically authorized to do so. -Do leave a meeting where any anticompetitive pricing or market allocation discussion occurs. -Do alert SOA staff and/or legal counsel to any concerning discussions -Do consult with legal counsel before raising any matter or making a statement that may involve competitively sensitive information. Adherence to these guidelines involves not only avoidance of antitrust violations, but avoidance of behavior which might be so construed. These guidelines only provide an overview of prohibited activities. SOA legal counsel reviews meeting agenda and materials as deemed appropriate and any discussion that departs from the formal agenda should be scrutinized carefully. Antitrust compliance is everyone s responsibility; however, please seek legal counsel if you have any questions or concerns. 2 2

4 Presentation Disclaimer Presentations are intended for educational purposes only and do not replace independent professional judgment. Statements of fact and opinions expressed are those of the participants individually and, unless expressly stated to the contrary, are not the opinion or position of the Society of Actuaries, its cosponsors or its committees. The Society of Actuaries does not endorse or approve, and assumes no responsibility for, the content, accuracy or completeness of the information presented. Attendees should note that the sessions are audio-recorded and may be published in various media, including print, audio and video formats without further notice. 3 3

5 Agenda Data Trends Data Protection Trends Supportive Frameworks and Tools for Data Protection 4

6 A presentation of two halves Establish a Defense and enable an Offense (Value Creation) 5

7 2018 Trends to Follow 6

8 Personal Data is Constantly Being Collected

9 What data could we use? Estimated average number of customer interactions per year Life Non-Life Motor Health Retail Telco Banking Technology Companies Social Media Source: McKinsey & Company, presented in Transforming Life Insurance with Design Thinking 8

10 A wide variety of information is being accumulated and used Basic Demographics Age Gender Social Media Usage Avocations Insurance purchasing Marital status Number of Children Driving Behaviour Credit Behaviour Well-being Stress Behavioral Depression Socio-Economic Education Occupation Benefit amount Investment choices Where you live Activity Diet Car ownership Smoker Status Care provider Alcohol consumption Sleep Previous claims history BMI Blood pressure etc Assets Disease history Salary Family History House price Prescription History Heart Rate / HRV / etc Genetic Data Omic Data Health and Biometrics 9

11 Linking Data Sources Unique insights and robust solutions to business problems do not exist within a single data source neither should our analyses and solutions Mary Datasets, in combination, can create unique insights about Mary Traditional U/W Data Traditional Policy Data Traditional Distribution Data There s Something About Mary Rx & Wellness Data Financial & Credit Data Lifestyle and Psychographic PII is required for linkages Health and Disease States MVR Data Social & IoT Data Without PII, we become limited in our ability to better understand the multifaceted forces that predict future life events of Mary (and others) 10

12 Insurance Value Chain and Applications Pre-sale Underwriting In-force management Claims New rating factors Underwriting risk segmentation Underwriting triage Fraud / Nondisclosure protection Multivariate experience analysis Cross-sell and up-sell Fraud / Nondisclosure protection Propensity to buy Distributor quality management Propensity to complete purchase Determine underwriting ratings Proactive lapse management Claim management Claim validation Competitive pricing strategy Agent assessment Structured/ Unstructured Data Customer lifetime value Claims triage Level of Demand High Medium Low 11

13 Data Protection Trends and Regulatory Climates

14 In the News: Data Breaches According to Forbes, in 2018, an average data breach incident costs the highest in U.S. as $7.91 million

15 Regulations driving change around the globe Shine the Light California s Shine the Light privacy law GDPR General Data Protection Regulation European Union Cyber Security Law China Asia-Pacific Economic Cooperation s (APEC) Cross-Border Privacy Rules (CBPR) APPI Act on the Protection of Personal Information Japan PDPO The Personal Data (Privacy) Ordinance Hong Kong POPI Protection of Personal Information Act South Africa 14

16 Medical New Forms Motor Data Of Vehicle Was Data King Hit Records The Market Validated Supportive Frameworks and Tools

17 Privacy by Design: A Framework Developed by Ann Cavoukian Privacy is to be taken into account as it relates to design and operation throughout the whole of IT systems, networked infrastructure, and business practices Proactive not reactive; preventative not remedial Privacy as the default setting Privacy embedded into design Full functionality positive-sum, not zero-sum End-to-end security full lifecycle protection Visibility and transparency keep it open Respect for user privacy keep it user-centric Take action in advance of the event, not after-the-fact Responsibility is on IT system design; not the individual Core and integral; not an add-on with potential diminished utility Win-win in for all legitimate business purposes; not a trade-off between privacy and security Data onboarding through destruction and all steps in-between are to be included Ensure the system is subject to ongoing compliance and validation to stakeholders Empower the user with strong privacy defaults and end-user options 16

18 Data Protection Capabilities Catalog Provides visibility into the data available in the an ecosystem sourced from internal and external sources. This may include origin or storage source, data content, usage, or other elements the organization deems important to see and track Detect and Classify Analyzing the data set to identify fields that could contain PII, as well as combinations of fields that could be used to identify an individual. Data is then classified according to defined sensitive fields Master Person Index Evaluates two or more data records containing the same, or similar data elements to make a determination if they are for the same individual Protect Protecting sensitive data through a variety of techniques, including anonymization, pseudonymization or redaction, and enabling only authorized users to see specific data elements in the clear 17

19 Capability: Catalog Ability to register and track data sources Benefits Enhances the data onboarding process Provides visibility and single source of truth for data, sources and projects using them Risks Potential security concern given catalog could be exposed Potential financial impact at different capability levels Opportunity to cross-leverage sources Identifies gaps for future data acquisitions Enables regulatory compliance efforts Measures of Success # of sources % of sources in catalog Date range of data available Geographies available Attributes available by geo or demographic Where PII is located Time spent cataloging 18

20 Capability: Detect & Classify Ability to identify fields or combinations of fields that contain or constitute PII / SPII Benefits Enables regulatory compliance (e.g. GDPR) Provides visibility into location of PII in applications and data sets Risks Mishandling of PII, due to vague definitions Hefty regulatory fines due to regulatory noncompliance Increases auditability Creates organizational consensus and clarity on PII definitions Measures of Success # of data sets classified # of classified fields/columns Adoption by business units Dollars fined Adoption resistance depending on level of maturity Decreased productivity due to additional process steps # of classifications based on regulatory entity # of instances estimated vs. observed Location of PII 19

21 Capability: Master Person Index Evaluates two or more data records containing the same, or similar data elements to make a determination if they are for the same individual Benefits Reduces time spent on manual linkage Manages jumbo risks / retention limits Builds trust in assigning aliases, across different partners and different data sets Risks Could lead to inefficient use of partner data sets if incorrectly linked Potential data redundancy Potential flaws in procedures, selection bias Increases data quality Measures of Success Reduction in record linkage time % of false positives or false negatives % accuracy based on samples taken # of new partnerships acquired over time % of enterprise adoption # of linkable datasets 20

22 Capability: Protect Ability to protect PII from unnecessary exposure in the enterprise pipeline Benefits Minimizes risk and engenders trust PII/SPII unintended disclosure risk is reduced Enterprise-wide implementation would ensure GDPR compliance Risks Removal of fields could impede analysis Adoption resistance If policy definitions are too lenient the tool may not be leveraged efficiently Enterprise, integration risk due to potential number of touchpoints Measures of Success Relies on the detection capability to quantify protected data Data risk assessment reduction # of supported applications # of fields # of users % of enterprise adoption # of new external partners acquired over time 21

23 A Few Protection Methods Data Protection Anonymized Alternatives Anonymization Differential Privacy Tokenization Psuedonymization Webster In- Data Practice Remove identifying information from something so that the original cannot be known (None) Method that seeks to maximize accuracy while minimizing the ability to identify the identity of data subjects Symbol representation, or distinguishing feature Use of a fictitious name Processing of data that can no longer be attributed to a specific data subject without the use of additional information Random generation of a value for plain text, which is then stored in a mapping database Distinguishing Features One-way; permanently removes the personally identifiable information with no way of getting back to it Adds random noise to the data while retaining meaingful aggregate statistics; can be applied to the ride-along data attributes Can switch the data between the masked token and in the clear as it moves through workflows Adds a field with a pseudonym associated with the identity; preferred method when needing to link data sources on the same individual identity 22

24 Anonymization Raw Input National ID Name John Doe DOB 10/12/198 3 HIV Indicator Smoker Indicator BMI Y Y 24.5 Protected Output National ID Name John Doe DOB 10/12/198 3 HIV Indicator Smoker Indicator BMI Y Y 24.5 Advantages Low risk of re-identification Theoretically impossible to get back to the identify of an individual (if anonymized properly) Disadvantages Static Cannot merge with other data sources 23

25 Differential Privacy The Issue Nationa l ID Nam e HIV Indicato r 123 John Y 456 Jane Y 789 Bob Y 111 Betsy N 333 Zach N Public Aggregate Analysis: 3 out of 5 people have HIV 24

26 Differential Privacy The Issue Nationa l ID Nam e HIV Indicato r 123 John Y 456 Jane Y 789 Bob Y 111 Betsy N 333 Zach N Public Aggregate Analysis: 3 out of 5 people have HIV What about Bob? Suppose an adversary gets aggregate analysis, and all data records except for Bob Nationa l ID Nam e HIV Indicato r 123 John Y 456 Jane Y 789 Bob 111 Betsy N 333 Zach N Adversary can determine that Bob has HIV 25

27 Differential Privacy A Solution National ID Name HIV Indicator 123 John Y 456 Jane Y 789 Bob Y 111 Betsy N 333 Zach N...additional people Before Differential Privacy Aggregate Analysis: 600 out 1000 people have HIV Differential Privacy Applied Adds random noise to a returned query via a mathematical function with a specific privacy parameter, ε After Differential Privacy Agg. Analysis #1: 574 out of 960 have HIV (59.8%) Agg. Analysis #2: 589 out of 980 have HIV (60.1%) Differential Privacy ensures the above two analyses are differentially private Advantages Minimizes risk of identifying individuals upon stitching together disparate pieces of information Disadvantages Need to take into account the number of queries/analyses that will be conducted to ensure differential privacy is retained 26

28 Tokenization In-force Data National ID Name DOB HIV Indicator Smoker Indicator John Doe 10/12/1983 Y Y 24.5 BMI User: Analyst National ID Name DOB HIV Indicator Smoker Indicator 128*$ksdk 893fdz*& 90djg24 Y Y 24.5 BMI User: Claims National ID Name DOB HIV Indicator Smoker Indicator John Doe 10/12/1983 Y Y 24.5 BMI Advantages Protects the identity of the individual when it is not necessary Software can token/de-token as data flows through different systems and users Disadvantages Tokens by themselves are not consistent for the same data subject coming from different data lineages 27

29 Psuedonymization Raw Input Name DOB HIV Indicator John Doe 10/12/1983 Y Name YOB Smoker Indicator Johnathon Doe 1983 N Protecte d Output Psuedo Name DOB HIV Indicator Pseudo Name YOB Smoker Indicator 123ABC Y 123ABC N Advantage s Enables merging of de-identified datasets via common pseudonyms Dynamic ability to merge new sources to existing sources over time Disadvantages Requires significant investment in an identify management service to link data subjects Requires IT and role-based separation of duties to minimize re-identification 28

30 A Structure for Focus on Data Two key components to ensure data (i) governance/control and (ii) value maximization Data Organization: New Data-Driven Initiatives Identified Identify Data Manager for Initiative Document Data Specs & Intended Use Cases Privacy Impact & Data Plan: Access Governance Controls Value Maximization: Explore new data Augment Relevant Data Sources Link Data Isolated Virtual Server: Sensitive Data Analytics Sandbox: De-Identified Data 29

31 In Closing Why does data protection matter to a Data Science capability? Prevent inappropriate use Damage to reputation Loss of business (current and future) Substantial fines, damages, and costs Engender Trust from data contributors Keep the data flowing and therefore things to do 30

32