In recent years companies have focused on collecting data and have found it to be the new oil. However, alongside the collecting of data, it is essential to think about how the data can be utilized, commercialized and productized. Can a company utilize all the data it collects – and just how clean is this new oil?

How can a company be sure that it has the right to use the data?

In business it is essential to identify the nature, content, source and intended purposes of data. It matters whether the data is personal data or other business-related data. The company must also know the origin of the data, and it must define and document the goal, i.e. the purpose, of collecting and processing the data.

It is necessary to be aware of the restrictions on the use of the data. Regulation related to the collecting, storing, protecting and use of data has increased, and lately it’s been virtually impossible to avoid hearing something about the EU’s new General Data Protection Regulation (GDPR), which imposes new obligations and restrictions on the use of personal data.

GDPR is on the way, but there are also other regulations

In the case of personal data, it is essential in terms of the new GDPR to determine, among other things, the processing principles and life cycle. At the same time, all the rights of the registrants related to personal data must be realizable, including, e.g., access to the data and removal rights. Companies must also be able to comprehensively demonstrate that the data management related to the personal data complies with the new regulation. However, keep in mind that the GDPR applies only to personal data, not to other data. If and when possible, it may be advantageous to change personal data into anonymous business data.

Data can get protection also as a business secret, database or, in some parts, from a copyright. Data cannot be owned in the same way as, say, intellectual property rights; that’s why agreements often play a significant role. In terms of business secrets, the new trade secrets act brings additional protection, but the position of agreements is emphasized in this regard.

Companies must identify the agreements or other terms related to data collecting and processing, and how data is processed with third parties. The verification of the agreements and legislation is fundamental, i.e. is all the collected data “clean” and can it be used. There may be a need to amend current agreements, update usage terms and/or obtain consent from private parties.

Data management as a foundation of business

Companies should develop a comprehensive and strategic approach to data management. Documents and agreements must be examined regularly as part of a broader data management program. Data strategy and, as a part of it, the identification of regulation, creates a good foundation for more data-centric operations and also ensures the value and usability of the data.

After implementing the GDPR projects, the next step is to give even more comprehensive consideration to the usability of the data.

Further information:

Markus Myhrberg, partner, puh. +358 40 505 5343, [email protected]