John Naughton 

Like fossil fuel in the ground, customer data may soon be a liability, not an asset

The massive fines imposed on companies such as BA and the Marriott group are a warning to big data hoarders
  
  

british airways planes taxiing at heathrow with a very dark storm cloud above
Dark days: BA was fined £183m for a data breach that leaked the details of 500,000 customers. Photograph: Stefan Wermuth/Reuters

A hedge, says Wikipedia, is “an investment position intended to offset potential losses or gains that may be incurred by a companion investment”. Most stock market investors (and pension funds) buy shares in the hope that they will go up in value, and are distressed if they don’t. In the 1940s a genius called Arthur Winslow Jones invented an investment fund that could place bets on both rising and falling share prices and therefore make money no matter what happened. Thus was born the hedge fund, the defining characteristic of which is that it eschews optimism and profits from well-informed pessimism. Hedge funds are thus the predators of the capitalist jungle, constantly on the lookout for prey.

A few years ago some hedge-fund guys, pondering the threat of climate change, came on a campaign conceived and orchestrated by the Guardian, Keep it in the Ground. As the then editor, Alan Rusbridger, described it: “There are trillions of dollars’ worth of fossil fuels currently underground which, for our safety, simply cannot be extracted and burned. All else is up for debate: that much is not. We need to keep it in the ground”.

What, the hedge-fund guys asked themselves, would be the investment implications of this policy? They embarked on an analysis of the annual reports of several hundred of the world’s biggest companies. What they were looking for was whether each company’s stated assets included fossil fuel reserves which had not yet been extracted. And the key question then was: how would the valuation of each company be affected if the value of those assets were written down to zero?

I don’t know what these investors did as a result of their analysis, but the story came back to me last week with the announcement that the UK Information Commissioner’s Office (ICO) had fined the Marriott hotel chain £99.2m for a data breach that happened in November 2018. The breach involved the theft of 500 million customer records from the company’s guest reservation database. A few days earlier, the ICO had imposed a fine of £183m on British Airways for a breach that had leaked the data of half a million users.

“Data is the new oil” is a tired metaphor designed to capture the fact that, just as the old economy ran on oil, so the new digital economy runs on data. Just as plentiful reserves of underground oil were good for oil companies, so the possession of masses of data would likewise be a great asset for tech companies lucky enough to have it. And whether or not they count it explicitly as an asset on their balance sheets, in practice it gives them a powerful bulwark against competitors and startups. It’s no longer enough for a couple of grad students to come up with a better search algorithm than Google’s, for example; they would also have to build a global network of massive server farms – and have acquired exabytes of data. So possession of large quantities of data greatly heightens the barrier to entry for competitors and thereby strengthens incumbents. The more data you have, the better.

The ICO’s recent fines, however, cast a shadow on this cosy scene. Possessing oodles of data is only an unalloyed good if you can protect it from thieves, hackers and other criminals. If you can’t, then that precious asset can suddenly turn toxic – just like fossil fuel reserves. And as a result your balance sheet no longer looks quite as inviting to investors. Apart from the reputational damage – public humiliation, exposure of corporate incompetence, etc – there is also the matter of the fines. Prior to the EU’s GDPR (General Data Protection Regulation), many of the penalties levied by data-protection authorities were risible, especially to large companies. But under the GDPR the bill can run to 4% of global turnover. As the man said, a billion here and a billion there and soon you’re talking real money.

More important, however, the centrality of data in the tech economy provides a useful indicator of where the main levers for regulation may lie. Facebook (with global revenues of $55.838bn in 2018) could easily absorb a 4% fine ($2.23bn). But if regulators insisted that it had to open up its data trove to competitors then that would really hurt. Also, the announcement two weeks ago that the UK Competition and Markets Authority is embarking on a major investigation into the hidden data trading markets that underpin both Facebook’s and Google’s current prosperity suggests that – finally – governments are beginning to flex their muscles for the coming fray with the tech giants. It’s taken an age for this to happen, but better late than never.

What I’m reading

Is this a tourist trap?
Vice says China is forcing tourists to install text-stealing malware on phones at its border. Surprise, surprise. Networked totalitarianism is alive and well.

Be good or begone
The Guardian reports that Instagram has come up with an idea to prevent bullying on the service. Basically, it’s an AI-powered invitation to think about whether you really mean to post something. I’m sceptical.

Money talks…
Why do American universities accept so much Saudi money? Michael Sokolove’s Llong, readable New York Times essay comes to an obvious conclusion: US universities have an insatiable appetite for money. And the Saudis plenty of it. British universities, please note.

 

Leave a Comment

Required fields are marked *

*

*