A Facebook lesson for startups and data-driven firms

Singapore

SINGAPORE'S data-driven companies and startups have to become more conscious of the need for proper data management practices following the reputational fallout from Facebook's data breach scandal, said industry observers.

It is not just the tech companies that should be concerned - companies across a broad range of industries from retail to education to entertainment often collect data for business reasons.

"Companies often hold more data than they are aware of," Joanne Wong, senior regional director for Asia Pacific and Japan at security intelligence company LogRhythm, said.

"With companies going through digital transformation and more consumers demanding personalisation, storing and sharing data are going to be the norm," she added. "Therefore, more needs to be done to ensure that organisations have the right protective measures in place."

News broke recently that Cambridge Analytica had improperly obtained personal data on 50 million users on Facebook.

The British political consultancy was then able to build voter profiles that purportedly helped Republican candidate Donald Trump's 2016 election victory.

The resulting furore from the revelation has sent Facebook shares tumbling, and the hashtag #DeleteFacebook soaring online.

In a survey released on March 27 by LogRhythm - of IT executives in the US, United Kingdom and Asia-Pacific - 39 per cent of 251 Asia-Pacific respondents said their companies faced a cybersecurity breach in the past year.

Closer to home, Uber revealed in end-2017 that the personal information of 380,000 people in Singapore were exposed when the ride-sharing giant was hacked in 2016.

There may be a temptation among startups in their youth to be careless with data as they aggressively experiment with ways to grow their business - a process known as "growth hacking" - said Hugh Mason, chief of corporate accelerator JFDI.Asia.

But any data mishandling that comes to light would pose a significant risk to their reputations and even valuations, he said.

Investors say that many startups here are already careful.

"I haven't seen any startups here that have abused the trust of the users in terms of data," said Golden Gate Ventures principal Justin Hall.

Part of this may be due to strong legislation here, he said. Under the Personal Data Protection Act (PDPA), businesses can be fined up to S$1 million per breach.

According to a March 26 report by global market intelligence firm IDC for Dell EMC, this makes Singapore in the Asia-Pacific the country with the highest financial penalty that can be imposed for a breach of data privacy, as a percentage of the country's gross domestic product.

Following the Uber breach, revisions to the PDPA are expected to be tabled in Parliament next year, to require individuals affected by a breach to be notified "as soon as practicable", and the Personal Data Privacy Commission (PDPC) to be notified no later than 72 hours after a breach is identified.

Sid Deshpande, research director at Gartner in Singapore, said that in the wake of the scandals, "the big question for (regulators and government bodies in Singapore) is how they can regulate data driven companies such as Facebook and their developer partners effectively while still allowing their business models to flourish".

He added that companies collecting data from users and consumers need to make sure they collect only what they absolutely need to provide a service, and make sure the consent sought from consumers is clearly articulated.

Consumers must also be fully aware of the various possibilities that may arise out of the usage of this data by the company in question, he said.

Mr Terence Sim, committee member of the Singapore Venture Capital and Private Equity Association (SVCA), added that startups could consider sharing aggregated data-sets rather than individual data to maintain privacy of the individual users.

He said that as part of their due diligence process, most investors would consider how startups handle data.

"Most investors have an internal environmental, social and governance policy that we adhere to and this would always be taken into consideration when we make an investment," said Mr Sim.

Mr Mason said what could also help are industry guidelines for questions to ask startups in early-funding rounds about their data-management practices, and what they have done to correct any past issues.