Our analytics team proposed a retention model built entirely from data we already hold. No purchase, no new collection, four weeks of work. It was refused, and following the reason took me through the least understood part of our data estate.
The information was gathered to bill people and to deliver a service to them. Scoring those same people for a retention offer is a different purpose, and whether that is permitted depends on what we told them at the point of collection. So we went to establish what we had told them.
We could not. The privacy notice was rewritten in 2019 and describes the organisation we were then. Information arrives through thirty one forms and portals owned by six departments, each with its own wording, and that wording lives in a content management system with no version history, so the text somebody agreed to in 2022 no longer exists anywhere. Three of the five proposed uses were abandoned, not because they were unlawful but because we could not demonstrate they were lawful, which in front of a regulator is the same answer.
Two other things fell out of the exercise. We are still collecting four fields for a marketing programme that ended in 2020, unread by anybody since. And customers who came to us with an acquisition in 2021 had never been told anything about us at all, which is a conversation I would rather have had before a model was proposed on top of it.
The catalogue now records, for every significant field, where it is collected, what the person was told at the time, which purposes that covers and how long we keep it. Two pages per source, stored with the schema, versioned whenever the wording changes. A new use is assessed in about a day. It previously took six weeks of correspondence and generally ended in a shrug.
The analytics team rebuilt the model on the two uses that were plainly covered, and it performs acceptably.
Holding the data is the easy half, and it is the half every maturity assessment measures. The expensive question is whether you can still show what you promised in exchange for it.
– Serguey Shinder
