How do we make privacy practical? | Danny Tyrell, DataCo

DataCo co-founder Danny Tyrell joins the podcast to discuss how his company helps companies to learn more about their customers in a privacy-preserving way, by connecting them with trusted data sources. At the core of this is maintaining customer trust, and Danny, Anthony, and Kris go deep on what trust means in the context of this technology, as well as how privacy legislation plays a part, and whether there is a place for data brokers.

They also discuss:

• Danny’s background in sports analytics and consulting.

• What is DataCo, and who is Colin?

• The importance of trust and privacy-enhancing technologies.

• Making trust practical, and the role of data brokers.

• The impact of privacy legislation and governance.

• Data brokers and setting the standard for responsible data management.

• The future of data privacy.

• Top advice for organizations dealing with data issues.

Resources

• 🎧 FILED S2E4: When preparing for privacy reform, privacy by design is key | Chris Brinkworth, Civic Data

• 🎧 FILED 10: Organizations must keep pace with evolving privacy expectations | Yvonne Sears, ISD cyber

• 📨 FILED Newsletter: The data privacy regulation floodgates have opened. Time to catch up.  

• 📏 Benchmark: How much PII does the average organization store?

Transcript

Anthony: Welcome to FILED, a monthly conversation for those at the convergence of data, privacy, data, security, data, regulation, records, and governance. I'm Anthony Woodward, CEO of RecordPoint, and with me today is my co-host, Kris Brown, RecordPoint's VP of Product Management. How are you, Kris?  

Kris: I am very good, Anthony. I have the right amount of Olympic fatigue, I think, all in a good way, watching it in the evenings. And in the mornings, French time doesn't really suit us here in Australia at this point in time.

Anthony: Yeah. Up until today, I've been sending all of my American friends, the screenshot of the medal tally, but unfortunately, it's the last point that I get to tell them that the USA is not, not above this of a tally. The 27 million people versus the 330 million people is a lot of fun. We also today have joined by the co-founder of DataCo, Danny Tyrell.

Danny, you built a data platform that's built for highly regulated enterprises, and it sounds fantastic and amazing, and I can't wait to drill into it, but how are you going today, Danny?  

Danny: And I'm going very well, thanks, and thanks for having me on the show. Kris, I think I'm not quite Olympic fatigued yet.

I don't think I've been waking up as early as I should be to watch it, to be honest, but I do have the complaints around the time zones. When you don't get to watch all of the fun stuff. It's like, we only get to watch the heat at night before we go to bed. And then you miss all the, the metal events.

So, I've also got a bit of a complaint around the time zone.  

Kris: Yeah. Getting up in the morning and not grabbing your phone because it's like, I have to avoid social media. I have to avoid the news until I get the opportunity to go and watch the highlights and I've specifically gone and bought the package so that I can watch individual sports.

So, I've got the list up. Is it's. I'm a bit of a tragic certainly, you know, sports my thing, but yeah, a tiny, tiny little bit of fatigue sitting in after week one. And I'm sure this time next week, I'll probably be more of a mess, but look, Danny, I'd love to start to hear a little bit about yourself, how you started.

You gave us a little bit of a tie there in the sort of the green room beforehand about you've got a little bit of Olympic experience for yourself, but obviously then how we came to be at DataCo and. I'll ask you a question later about Collin, but my favorite named thing ever, just so we're clear.

Spoiler alert for later folks, but give us a little bit of background, Danny, for the audience.  

Danny: Yeah, absolutely. So, my journey actually kind of into the professional domain did start in sports analytics funnily enough, which is why I have such a fun liking for the Olympics. So, I came from this mathematics kind of systems engineering background, but it's been a number of years playing elite sport when I was growing up.

So, back into my university days, I actually was asked if I wanted to go into the sports analytics space at the Australian Institute of Sport with the Australian men's volleyball team. And so, I spent four years working in that domain. So, it was all kind of, think Money Ball, like live in game statistics, strategy.

Really taking analytics to how you perform to the peak and through that experience was lucky enough to actually go along to the London games. I wasn't our best performing games as a nation, but the whole experience and London kind of came to life through that, that whole time. And I have just such fond memories of kind of traveling the world and going to these incredible different locations, but really applying analytics in a real-world domain.

After I went through that journey, I kind of made the decision that sports wasn't going to be the space that I would take a full career in. There was some other things from a professional and business standpoint that I wanted to maybe try and explore a little bit. So, I spent a number of years actually transitioning into the consulting space, working for both Accenture and PwC, kind of all the way from this core technology delivery all the way up the stack, more into the consulting and strategy space. And the end of my time in consulting, I was really thinking about digital ecosystems, new digital ecosystems, new business models, kind of how you start to collaborate and wasn't just this kind of, you've got this narrow vertical, but actually how you start to come together in the digital economy.

And that's really what landed me across into. What was the, the venture capital innovation arm of ANZ bank who were looking to explore more concepts into this space. And that was really the start of what DataCo was today.  

Kris: Yeah. Awesome. And again, I think the one of, or at least core part of the products is, is a product called Collin.

Give us a bit of an understanding of Collin. I said Collin, it couldn't get any more of an Australian name for a product, right? Like that is just gold.  

Danny: Collin is, he's a fantastic guy. So, who Collin is, we wanted someone who was just like steady, reliable, like he'd been there, he'd done that, and Collin really is our generative AI capability, which is all around how you can do collaborative analytics, but leveraging kind of the cutting-edge technology you're getting from Gen AI.

But maybe before I go too much into Collin, just maybe unwinding a little bit about like, what actually is DataCo in this domain? It's really how we perform collaborative marketing and analytics. It's really the space that we're really starting to carve out. And it really started from years of trying to collaborate in strategic partnerships, particularly from the bank.

So, we were tasked when I'd moved across into, into 1835, or at the time it was called ANZI, it was a, Innovation and Venture Capital Function associated with ANZ Bank. And it was really about why do we never unlock the full value of our data as a bank? We know it's very rich. We've got really amazing partnerships.

And that led us to kind of explore the market, try to understand what we could use. And fundamentally, nothing did it in this safe, secure, but ultimately simple and kind of practical way. And that's why we built out kind of the core of the platform and that's taken on many different iterations. But Collin's just really the icing on the top.

He's really the cherry that sits there and kind of takes what we used to think about in terms of user interface and starts to reimagine what that's going to look like going forward.  

Anthony: Yeah, that's a fantastic background. I love the drill into that a little more around the context of in the real world, what you're solving for organizations.

Cause I think what you talk about there, you know, large bank, lots of data in terms of ANZ's problem, but there's some real practical applications of this technology, aren’t there?  

Danny: Yeah, absolutely. And fundamentally, I think the best way to think about it is marketing is kind of the main domain we really focus around.

But marketing is a very broad kind of concept within an organization. And the key things that people are trying to solve in this domain are really just how do you better understand your customers? How do you better understand how to engage customers and where to engage the customers in the right way?

And then how do you want to measure what's actually happening from an effective standpoint so you can continuously improve what you're doing in terms of how you interact with your customers. And one of the challenges that we've always found in this space is that organizations fundamentally have quite a narrow view of their customers based on what they do in terms of interacting with their brands, the certain domain that they operate in.

And then ultimately, because of that kind of limited interaction, they also have this limited ability to engage with them in the right way. We always have these kind of backgrounds, and then we're hitting on with this like new landscape of privacy changes, people being uncertain around what's happening with their data, things like these old third-party data sources, which have consistently been used, which have been like put under threat with some of the regulatory changes and that all combined with kind of the last of what is kind of your Facebook and Google marketing ecosystems, which are just so noisy and people are getting bombarded. So, really what we're trying to solve from a really practical standpoint is how can organizations just find trusted data sources to help them understand their customers better and go through strategic planning, find the right ways to have really safe and kind of compliant activation into really Targeted channels where they can reach the right customers at the right time.

And then really use some interesting data signals to do measurement. That's not based on things like clicks, but actually what the business performance is off the back of these campaigns.  

Anthony: That's a really interesting space. And there's a lot of intersections here with a lot of the things we talk about.

As you do a lot of work thinking about synthetic data and different ways to model data and how that. Comes into the use of these data sets. What does that really involve? And why is that important when we think about privacy?  

Danny: I think particularly the synthetic data concept, and I think more broadly, the concepts that we look at, particularly with our platform is all around this privacy enhancing technology space.

And the fundamental principle of this domain is like, how do you continue to create utility from data? Without jeopardizing individual privacy or commercial sensitivity. And this is one of those things where there's a lot of people kind of in the real hard lines of data security or data privacy being like, stop sharing data, stop sending data around.

There's no data that can go anywhere. We need to really lock it down. And that's just not a really practical way of thinking about the world. Like fundamentally, there's so many problems that we need to solve where we have to be able to share information, and that's the only way we get a functioning economy.

It's the only way we get functioning ecosystems. So, a lot of this domain has been around. Well, what different approaches do we have? Whether they be technological approaches, whether they be kind of legal structures, whether they just be processes and things that we put into place that help us to maintain the generating of utility while making sure we do keep people's data safe and in compliance with what they've actually given us permission to do.

Anthony: I suppose one of the things that again is a reoccurring theme in these conversations is trust, right? Because that's really, we're talking about is how do you establish that trust and in your world and how you think about it, what does trust mean to you here around these data sets and that permission and the consent that comes with it?

How do you make that practicable?  

Danny: Yeah, I think making trust practical is quite a difficult concept because trust is one of those things. It's the age old, like it takes years to gain trust, and it takes like a second to lose trust and trust really comes in a few different flavors. I think it's kind of just this commitment to doing the right thing.

It's like, that's just setting out to make sure that you're being in line with what you say you're going to do, being consistent with what you're saying, and that's kind of this, like, first component of it. Then there's a second component, which is really around actually the follow up. So, not just what you say, but actually what you do and making sure that everything that you do kind of always delivers on what you've said you're going to achieve, and that might be I've got information security obligations that I said, I'm going to control.

I've got certain purposes, but fundamentally, I think there's always this layer of trust, which has to come down to more of that, like the backbone of ethics, I'd say, and it's either, like ethics slash just like doing right. And I think if fundamentally people don't, at their core, have these ethical principles, which are baked into both what they're doing as an individual or what they're doing as their organizations, like, they're always going to be found out at a point in time.

But it doesn't matter how much you say you're doing the right thing, and you can try to show you're doing the right thing. If you really don't have that core of, no, we actually are trying to do the right thing for what we mean, then you're going to lose trust. And that trust ends up in our domain, particularly in kind of B2B, so different organizations lose trust in the service provider.

Ultimately, where we're all trying to get trust is the, like, the end consumer. And the space that we operate in, we always talk about this data. That data at the end of the day belongs to these individuals, different businesses who collect this data, install this data, who process this data, they're more of a custodian and it's like an obligation for them to be able to do the right thing on behalf of the individuals.

So, like, collectively, it's an ecosystem that's about, how do we all work together to make sure we're maintaining that trust? Because that's what's going to allow us to continue to build value and use data and do an interesting loss.  

Kris: Yeah, it's really interesting sort of hearing you tie that back to that end user.

And even though there are many parties that are involved around those data structures, I think the more recent, not directly related to data, but just even that trust element. I was in a supermarket when the CrowdStrike outage started to hit Australia. I was lined up like everybody else just to pick up a couple of items in the afternoon and all of a sudden, the machines around us inside Woolworths, which is a sort of a supermarket chain here in Australia, all started to turn blue.

And then, you know, there was some panic from the staff initially, and an individual jumped on the microphone and sort of explained they were having a bit of an issue, but they instantly went to, we're having a problem with Microsoft, and it's like, that was the easy target. We're aware of what's going on.

Microsoft is doing this, that or the other. And even I, and I know better than this, I got caught up and was like, kind of quick flick through my status at Microsoft. And it's like, well, it doesn't appear to be anything major going on. You know, obviously we're a SAS provider. I'm like wondering what's going on here.

And it took a little bit to dig in to find out it actually wasn't that. But again, just that loss of trust and the people around me and the comments people around me were making. It's like, I don't carry any cash. You know, what am I going to do? And that was sort of opening up some of the tills to take cash.

But then the FPOS went down, it was just a calamity of errors. But back to that concept of trust, it was really interesting, almost watching the human psyche unravel as we took away the internet for a moment and our loss of trust of, you could feel like the, I was going to buy a Microsoft computer today, but tomorrow I'm buying an Apple sort of happening around me and, and not that I'm advocating for either there, but.

I appreciate the answers that you gave us there to those Danny, but again, this category that we're in deeply impacted by privacy regulations, you know, and lots of big up and then sorts of security controls because of that trust problem, obviously, how's the ongoing evolution of that privacy market impacted both your market, but also what you are doing and where you, again, obviously we've got upcoming it's, it's August now, Parliament sits soon here in Australia.

We're expecting lots of interesting things to happen, but how does that affect you?  

Danny: Yeah, I think the privacy legislation has many things to unpack, but just before I jumped there on that trust issue, I think what was interesting about CrowdStrike as well was we hear this a lot through again, a different legislative change in Australia to do with it's either CPS to one of the two, three, four, two, three, six, there's all this banking regulation that from Africa that we always get.

Pushed on, but a lot of it's been around third party and supply chain risk. And it seems like there's like silly compliance thing that you need to go through, but the CrowdStrike one was a perfect example with Microsoft, right? Where, as you said, Kris, like Microsoft, the one who's got the spotlight straight away and they're sitting there being like, this isn't even us, like this is someone else.

This has come through, but. The obligation kind of on the systems and the providers is actually if you're using third party service providers, it's your obligation as well to make sure that they're doing the right thing. So, I think it was a really good highlight just in the general collaboration and just the general ecosystem kind of space that trust is outside of your control.

And while it's easy to say, oh, legally, I've got this down in writing that I'm passing this on. That kind of doesn't matter when one of these events happen. So, I think that was just a, an interesting little point on, on the ecosystem. The maybe to, to the privacy change, there's a lot happening in this privacy space globally, but particularly in Australia, as you said, the legislative changes, which are going to come through.

Most likely in, in August and to see kind of pen to paper, you never hold your breath, but fundamentally, I think they're really positive changes for society and they're positive changes for our economy. What they're trying to change with the privacy legislation is just to tighten up some of the language around what does or doesn't class is like personal information, but ultimately.

One of the things which I know has got a bit of controversy around it is this fair and reasonable test and this idea of the privacy pub test and really what that's saying is doesn't matter how much you go and you put things behind consent banners or yes, I say I'm allowed to use your data for A, B and C.

It's about making sure that businesses are doing things in a fair and reasonable way. And of course, it's got some very big challenges in terms of how you mandate that, like, what does it actually mean? Go through the concept of like, even the pub test concept, I've always said on maybe on a couple of other podcasts around.

There's different pubs, there's heaps of different pubs in Australia. If you go to a pub and you ask a question in Bondi versus you go out to the back of like Yackandandah or somewhere, and you ask a question about like, what do people think in the pub, you're going to get very different answers. So, I think the pub test itself has some challenges to it, but the principles of what they're trying to do here is to say, use things in a safe and responsible way and make sure that everything's trying to be fair.

And from a business perspective, really what we're trying to do is make sure that there's at least this infrastructure component to being able to collaborate very safely and very simply and securely, but also with some of the data providers that actually there's a way of bringing new insights to businesses, which truly drive value.

And together we work with those businesses to say, maybe there's certain areas and use cases we need to make sure that we're avoiding, and we need to make sure that aren't being exploited, but we do think that net it's going to be positive if we can all use data in a in a safe and collaborative way.

Anthony: Yes, good point. I loved your explanation of the fair and reasonable. Maybe another time we can have a debate around whether that's truly a pub test. I'll put my, my lawyer hat on. I feel a little bit on the other side that fair and reasonable as a pub test isn't necessarily those two things aren't actually connected as some people are trying to connect it in the industry.

But I wouldn't mind doing a little deeper though about being a data broker, and it's probably again with my policy walk had on the mastermind 24 report came out talking about data brokers. Now I was living in the U S when the Equifax hack occurred and was personally impacted and to be honest, I was disgusted and continue to be disgusted with Equifax as approach response.

Well, they did, you know, I think I got 25 bucks back from them. Post the breach and it was just, it was an unreasonable process for the amount of money that they make off my data when, and they seem to have no responsibility to that. And I think what was good in the ACCC's report was obviously acknowledgement of those kinds of issues.

I'd love to hear your response to that report and where you guys sort of see that working. Cause there's a key plank in what we're all trying to build out in this space.  

Danny: Yeah. I think the data broker industry and the concept is A very interesting one. I thought that ACCC report kind of, I don't know if the, the purpose of it was to swing any punches, but it definitely felt like it pulled the punches a little bit.

And it was more kind of informative around what's going on, but I kind of share your sentiment Anthony around just some of the practices, which has happened in this space for a long time. Just, I don't think have been right. They don't sit comfortably from an individual consumer. I think even just like the…

It's like a house of cards. Really. I see a lot of these businesses. It's like, they've got this data, which has been amassed over years and years. And who knows where it's actually come from? It's the same with these, a lot of these ID spines as well, right? And fundamentally, if you ask them to go back and say, all right, I, as an individual want to say, take my data away from one of these companies, or know the companies that contributed to that and have that line of sight, it just mentally exists.

So, I do see some of these business models being challenged going forward. And a lot of what we're trying to build in terms of our collaborative ecosystems through DataCo is really, Like a new competitive model to some of those data brokers. So, we do have this core platform that we've enabled, which is just about fundamentally how you collaborate, but our model is to also work with trusted data providers to still create insights products that don't.

Abuse or expose personally identifiable information or lead people open to data breaches and things like that, but still create the value for the right use cases in this sector. Because as much as I'd like to say that the data broker industry is maybe not up to scratch. There's a lot of value that does come out of some of the use cases they deliver, particularly when you think through the whole business supply chain.

Because as I mentioned at the start, you've got a lot of small businesses who Do need to know more about their customers to be able to compete in this economy. I think sometimes we really hate this saying, I don't know why I always keep using it though, like the throwing the baby out with the bathwater style saying, but this is the same thing with the advertising industry.

I say, it's like, you can't say, oh, we're not going to do any targeting. Targeting's bad. We can't like, it's actually so many businesses like us as a business ourselves as a small business, we rely on efficient targeting through. Advertising platforms because otherwise we'd just be wasting all of our marketing dollars.

So, there's a middle ground here somewhere. It's more about who's willing to have the conversation to work out where we can get to this middle ground and what are the right approaches, technologies and solutions that are going to get us there in a safe and compliant way.  

Anthony: Yeah, great answer. I don't absolutely echo.

I think it does come back to some of those trust things. And maybe this is where we can agree on the pump test, right? What is the right thing to do as a conscious company thinking about the range of applications of this data, but using it in a way that does no harm? And I think that's the critical test.

I think for us at RecordPoint anyway, is how do we think about that? You know, the very notion that it. Folk are storing people's driver's licenses after they've been used to verify the person is just crazy. It's just so unnecessary, right? But that's certainly where we see the conversation needs to get to in some ways, even beyond the motion of pixel tracking and those things, which are actually less harmful in a way.

There are greater harms out there to actually focus on.  

Danny: Yeah, I completely agree. And I think trying to work out what the right harms to tackle are becomes very important, right? And we do get fixated on little issues and we try to blow them up. And it's kind of one of those policy things, right? Where you've always got these advocacy groups, which just try to see something and then they just try to double down on it and double down on it.

But again, it's more like who's willing to have the pragmatic conversations in this space, not be afraid to say some of these things aren't okay. And some of these things maybe we need to fix. Lighten up on, but at the end of the day, it's going to be a conversation, which is going to get us there.  

Anthony: Yeah.

And I think also setting some standards, I think it's on us, you know, DataCo as a startup, even record point as a startup at one land to set the standards for these bigger companies actually should start aspiring to. And creating that mode. And I think that's what we've loved and what we've seen with what is occurring with DataCo.

I would mind switching gears slightly and ask you more broadly, what do you see as the real future of this space? You know, we've talked very near term about privacy legislation and various aspects of the data breaking element and how data is managed, but where do you see this evolving to over the longer term?

And what do you think that world looks like? Like what's nirvana look like here?  

Danny: Yeah, so we've got to kind of touch on this slightly before, but we do have a pretty strong view around collaborative ecosystems really kind of being the direction where we're going to go towards. I think we're already seeing this in the, in the media space a little bit, particularly with the, like the retail media trend, which has been coming through over the last probably 12 months.

Where everyone's becoming more of a channel and different organizations are realizing their physical stores and our channel to, to interact with customers and some of their online presence is going to interact with customers, but also just the power of just working with a strategic partner in terms of accessing and talking to different customers.

And the way that we see it going forward is really. More and more of these collaborative ecosystems where you've got these different businesses, which are working together to either form joint products, joint marketing propositions, even again, I know we're focusing a lot in this kind of marketing space, but think about someone like a Toyota, like they're one of the top advertising spenders in Australia, but should they always just be going and just sending a basic Toyota ad?

What about them kind of partnering with, say, the four-wheel drive super center or like RM Williams, because a lot of their cohorts actually interact with brands that are together. So, we see a lot of these collaborative ecosystems and how brands interact across different industries becoming more and more important and more and more interesting for the people to deal with.

And so that's kind of one component to it. But then ultimately, I think kind of stepping away from just the lower hanging fruit in this marketing advertising space, it's more around trying to solve some of these big curly problems. And we actually have our own little podcast. We run to the side as well.

And we had Kendra Vant, who's one of the AI leaders here in Australia, really, she's got a really impressive resume, has done some amazing things from her kind of PhD studies over in MIT to working through a number of different organizations and now doing a lot of advisory work. And she was just highlighting the need to take a lot of these collaborative concepts and using data in interesting ways with this AI wave and then combining it with kind of big problems to solve.

But it involves us being able to re-imagine what we can do. And I kind of see the convergence of a few things like privacy is pushing us to change in a couple of different directions. But then we've got this wave of new technologies in the AI space. We've always known that data is very important to that and thinking about how all these things come together is really kind of where I see the world going.

Kris: So, Danny, thanks for that. And I think maybe one for the listeners to lean in on your expertise. So, you're starting to work in this space where you're dealing with these larger organizations, they're doing this collaborative work around their data sets and other things. Number of the listeners are going to be in organizations with this same problem, lots of data, they don't know what to do with it.

What's the one piece of advice that they can take away as to, you know, what are the things that they should be looking for, things that they should be doing next as it relates to their own data estate?  

Danny: I think if there was one piece of advice, it's very hard to narrow things down to one, but I think just fundamentally the principles before we move to anything is just stop sending raw data or storing raw data everywhere.

It sounds like a really boring thing to say, and I know you guys probably have a lot of thoughts on this in terms of what you do inside of organizations, but. There's just no excuse for it anymore. There are so many different approaches, and I do want to get to the point of talking about the right use case and getting through, but just know that there's no excuses for some of these large-scale data breaches because you just sent the data to the wrong place, or I've just been storing things for so long.

It's just like get the fundamentals right, because it doesn't matter how much we want to try to Think about a greater future and what we can all do together and the best uses of data. If people don't do the right things in terms of the fundamentals, we're just going to keep seeing these breaches and we're going to keep getting more legislation and we're going to get lose the trust of the individual consumers kind of to your point before Anthony.

And that's really what's going to harm us all. So, it's kind of like think big and talk about what you can do, but you have to do the basics, right?  

Anthony: Yeah, I, I always liken that to, and I'm always surprised that you wouldn't kind of take the jewelry box and put it out on the driveway and walk away, but people do it every day on the internet, right? That's crazy. Look, Danny, there's so much we could keep talking about, and I'd love to have a moment to talk to you about the, you know, digital platform services inquiry and some of the things that are happening also in the, the work around identity flow information, even in the U S.

Unfortunately, I think this is probably a good spot to wrap up and maybe even find time to do another podcast, another time to get into those issues. So, I really appreciate the time and for you dropping in and sharing your knowledge and thank everyone for listening. If you've enjoyed this podcast, please give us a rating on your podcast app of choice.

I would love to get some feedback on how the podcast is going and various pieces. I'm Anthony Woodward. Thanks for listening.  

Kris: And I'm Kris Brown. And we'll see you next time on FILED.

‍