By Eliott Mourier, Data Compliance & Data Privacy Manager, Micropole
If the strategic dimension of data in today's economy no longer needs to be demonstrated, it is important to note that data has also been the subject of significant and ongoing standardization work in recent years, at the national, European and even international levels.
These standards, laws, regulations and directives are imposed on companies, which must quickly comply with them from a legal and organizational point of view, but which must also and above all develop their information systems accordingly. This is often a complex task, since it requires dialogue and strong collaboration between legal entities and IT managers, who, for various reasons, have often had difficulty working together in the past.
RGPD, Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT, KYC), IFRS, Solvency 2, MiFID 2, Anti-Fraud and Anti-Corruption, etc., the list of texts that require economic actors to put their data under governance is growing year after year and on an ever wider perimeter of data. Financial and accounting data, personal data or data from customers and suppliers, transactions and payments, it is almost the entirety of the company's information assets that must now take into account regulatory requirements.
While each text offers its own set of legal expectations and technical guidelines, there are nevertheless certain guiding principles for data management that are systematically found in each of these data-oriented regulations . These principles are in fact the foundation of what is commonly called Data Governance:
- Data Quality: All the methods, processes, organization and tools used to ensure that data is complete, reliable, deduplicated, standardized and compliant with business rules and expected standards.
- Data Security: All the organizational, physical and software means guaranteeing maximum security of critical data, both in terms of confidentiality, integrity and availability of data.
- Data Analytics: The ability to derive insights and value from raw data, particularly in the production of the numerous regulatory reports required by many of these texts.
- Data Ownership: Data governance from a human and organizational point of view. The assurance of being able to identify for each critical piece of data owners , operational experts (data managers) and quality controllers (data stewards). It is also the need to be able to retrace the life cycle of the data and to produce an audit trail of all the transformations it may have undergone.
- Data Management: Good data management, both from a documentation point of view - to make sure we share the same vocabulary across the company - and from an IT architecture and urbanization point of view - to make sure we know where the data is and how to access it in a safe and reliable way.
Our conviction at Micropole is that " Data Compliance" must be built on a true "Data Governance" with each of the facets described above. Without this, and even with a well-constructed organization and control processes, regulatory reporting, LCB-FT suspicion declarations or even the restitution of a right of access to RGPD will remain incomplete, non-qualitative and unreliable, as they are still largely based on manual tasks. On the contrary, the construction of Data Compliance in close connection with Data Governance will allow companies to take the decisive step of industrializing and automating their compliance, which is more and more clearly required by the regulators (ACPR, CNIL, etc.).
