[00:00:00] - Adam Aft
Who has access? What are the controls? How long are we retaining this data? What systems is it residing in? What decisions is it being used in? Is it being used for team building? Is it being used for new product development? Is it being used for hiring and firing? All of those types of questions you need to ask as you're designing controls, because not all of the data that's being generated for employee monitoring is appropriate to be used in all of those contact.
[00:00:36] - Doug Foulkes
Hello, and welcome to Episode 67 of Chaos and Rocket Fuel, the future of work podcast. Yes, this is the podcast that looks at every aspect of work in the future. It's brought to you by WNDYR and Pattyrn. And I'm with WNDYR and Pattyrn CEO, Claire Haidar. Claire, I'm always with you. Nice to chat to you today.
[00:00:55] - Claire Haidar
Hi, Doug good to be here cohosting with you again. We skipped a few weeks and I actually am really happy to be back in the conversation with you. This is always a great way to get the week started.
[00:01:06] - Doug Foulkes
So today is the last opportunity that we have to chat to Adam Aft he's a partner at Baker Mackenzie. We're talking about data and what are we tying things up with in this last section?
[00:01:20] - Claire Haidar
So Doug if you look at our first episode, we looked at just like the overall landscape really just to situate our listeners and business leaders specifically around what is the current landscape today and where should they really be focusing their efforts? And from there, if you go into episode two with Adam, what we discussed there was really the Gray areas. And it was a great conversation because Adam really provided really great, practical tools that business leaders would be able to take straight out of the conversation around, well, where do we as a company actually start, navigating this issue and, and building some really good guardrails around it. And making it a collaborative effort between ourselves and our employees.
[00:02:02] - Claire Haidar
Then if you look at today's episode and the conversation that we're having with Adam today, it's building on that framework. So one of the questions I asked him is, what our lead is not considering, which they really should be considering. So looking at those blind spots, taking the blinkers off.
[00:02:20] - Claire Haidar
Then, you know, I love the question that you've got for Adam, which is, okay, if you were to teach this as a course at university what would the chapter titles be? What would the modules be? And again, you think about that, it's a good framework to enable business leaders to really think this through very systematically, because this is not it's complex issue. It's a really complex issues, we need to really emphasize that it's not something that is going to take a quick few hours and then it's done and dusted. This is a multidisciplinary team that's going to have to dedicate real resources to actually doing this properly and doing it well in a way that it doesn't jeopardize employees, but it also doesn't jeopardize the company.
[00:03:02] - Doug Foulkes
Sure. I think it's something that's going to get more complicated before it gets more easy.
[00:03:07] - Claire Haidar
Yes, definitely.
[00:03:09] - Doug Foulkes
Should we head over to Adam?
[00:03:11] - Claire Haidar
Adam, talk to us, if you think about our audience listening into this podcast, they're chief people officers, you know, heads of HR, CEOs, COOs, really just grappling with how to redesign digital workplaces. It's a highly contentious issue right now. And what are some of the really serious things that these leaders should be considering, which you don't see being considered in the work that you do?
.
[00:03:42] - Adam Aft
To the credit of your audience? I think most of the issues are reasonably top of mind for them. But the really the main issues that merit even further consideration than they're even getting now really go back to similarly, what I would have highlighted that the main challenges around remote and hybrid work, which are the cyber risk, the monitoring of employees, access to company systems, and then monitoring of the employees themselves.
[00:04:08] - Adam Aft
All of those are new at a scale that we haven't seen pre-pandemic, and in a way that is permanent in that Enterprises are continuing to face the challenge, whether it's full remote or hybrid work, either of those presents the same challenges, because even under hybrid, you still have the remote work component of it. So basically all of the future of work presents these challenges that are new at an entirely different scale. An Enterprise that three years ago had five percent remote workforce may now, once you met factor in hybrid, well over half their workforce has these work remote, work from home type circumstances. So really, really important.
[00:04:47] - Adam Aft
Happy to jump into any of the three of those, but I'll defer to you if there's a specific area that would be of great focus, or if you want to draw through all three?
[00:04:57] - Claire Haidar
Let's focus on the last one again, because it's most pertinent to our audience, but also what I would like to say is, and this is actually something that was a bit of a light bulb for me when you mentioned it was, I have actually never considered until you said it, the reality that companies are facing that they literally tapping into like smart devices in people's homes. And no company wants to be going there.
[00:05:23] - Claire Haidar
I can definitely say, I mean, if you look at us as an organization, we deal with a lot of companies who are grappling with these issues right now. And I can honestly say that that is an area that definitely haven't seen major consideration being given to. And yet it is actually a very serious thing. So I'd call that out as one. And then I'd love to hear your perspective specifically on that third one, which is the work productivity monitoring piece.
[00:05:50] - Adam Aft
Sure. Yeah. On that one of monitoring the home. It's an interesting area. It really gets into some of the nerdy IP WIPS, if you will about endpoint security, but it's one that is great at the C-Suite level to ask the IT teams, hey, as we're facilitating remote work, to what extent as part of our endpoint security, have we tapped into our employees internet of things, home cameras?
[00:06:16] - Adam Aft
Have we completely avoided that? And if not, what are we doing to put some guardrails around it? Because that gets scary, as you suggested. So it's really an area that does merit some, at least questions and hopefully not too many issues, but always good to confirm with respect to monitoring the employees themselves and how they're performing and how those tools might be used or otherwise.
[00:06:38] - Adam Aft
I think that's an area that's really important to spend a lot of time and we are seeing Enterprises spend a lot of time on trying to be thoughtful about implementing the controls they need to use that type of monitoring, whether automated or manual, but capturing the data in a new way really important to spend some time thinking about those controls.
[00:07:00] - Adam Aft
So the questions around, how are we collecting the data? Is this an automated tool that is a new tool? Is this an automated tool that's taking data that already exist, like an outlook calendar or emails and just using new monitoring function? What is it that we're actually doing?
[00:07:17] - Adam Aft
Then once you've identified what you're doing as an Enterprise, thinking about, okay, well, who should have access to what we're doing? Does just the employees manager need access? Or maybe the employees manager shouldn't have access?
[00:07:29] - Adam Aft
So really thinking through who has access? What are the controls? How long are we retaining this data? What systems is it residing in? What decisions is it being used in? Is it being used for team building? Is it being used for new product development? Is it being used for hiring and firing?
[00:07:49] - Adam Aft
All of those types of questions you need to ask as you're designing controls, because not all of the data that's being generated for employee monitoring is appropriate to be used in all of those contact so you want to really carefully design your control to make sure that the Enterprises come for with the decisions it's made around that.
[00:08:07] - Adam Aft
And then the flipside of that coin, as we've talked about, is once the Enterprise has made those decisions and implemented those controls, communicating really clearly, providing clear notices to employees, so that they understand what's being used, so that they understand that they may be monitored for performance, or that that performance monitoring, through how they use outlook, may be used in their performance review discussion, and really communicating that to the employees so they have an understanding of what's going on. I think those are really important.
[00:08:36] - Adam Aft
They're issues that were present before the last couple of years, but again, not at a scale like we're seeing now. And, and that scale is, I think, what really prompts that need to invest more significant resources and being thoughtful and careful about this issue.
[00:08:50] - Claire Haidar
I think that's definitely, as I'm sitting here, thinking this through, just like, forget the company that we are. Forget the product that we're building. Just as a business owner myself, we've got work to do in that area. And I think that's possibly where business leaders are underestimating just how detail this exercise really needs to be, in terms of just answering that first question that you asked is like, what all are we actually capturing?
[00:09:18] - Claire Haidar
I would venture to say that at least 80% of organizations don't have a handle on what all they're actually capturing, because there's so many different systems. Many of them are ghost systems that aren't even on it's radar, that are just accumulating data. It's really sensitive data in that it can lead to direct productivity outcomes or views of any one individual in the workplace. So I think that's definitely a very, very important takeaway from what you've just shared there with us.
[00:09:50] - Adam Aft
The easiest way I've found to think about it is just ask an Enterprise who owns which application, which IT App that's it. Just to ask that question. And you immediately see the challenges and awareness on the issue you just discussed, because the HR team owns their cloud-based HR application, but the it team doesn't quite know what it is, other than they've got to integrated into the network.
[00:10:12] - Adam Aft
And then similarly, each scheme had their own system, and then the IT function has their own system. And the data mapping of what are we collecting about our employees across all of those systems is usually somewhere where there is work to be done. So absolutely what you just said, I validated something. We spend every day pretty much working with clients on
[00:10:32] - Claire Haidar
Adam, can I ask you, for the customers that you are seeing working through this issue and being very thoughtful about it, what is that team typically look like? Who's comprised within that team, who's actually going about doing this analysis and putting that communication plan together and stuff? Because I'm assuming it's a multidisciplinary team.
[00:10:54] - Adam Aft
It is as you get to it really is a crossfunctional team. Interestingly enough, one of the ways that we often find our clients get to that crossfunctional team is the starting point may be the central it function to ask this question of what data are we collecting about employees? And the it function will often come back and say, we're, we're happy to help. And we have an inventory of all of the applications, but we're not the application owner in every and so we can't really tell you at that level of depth how it's being used.
[00:11:24] - Adam Aft
So it oftentimes needs to involve of representative from each organization that owns the application, the IT function. And then as well as the legal function, who really can help drive proactively this discussion around a deeper understanding of what the Enterprise is currently doing, and then helping use that information to develop and implement controls around the use of that employee data.
[00:11:47] - Doug Foulkes
So Adam, my last question is really maybe a little look into your mind, if you were to write a postgraduate course in data privacy with a special focus on the future of work, what would the main modules consist of?
[00:12:02] - Adam Aft
It's a great question. And at one point earlier in my career had thought about the Academy. And so I particularly like the opportunity to try and design a course and the way I would do it is really around three modules. The first would be Privacy Law Basics, as I think it would be essential for everyone to understand the building blocks and the current regime and framework that applies to data privacy and security, just to have a common understanding and common language.
[00:12:31] - Adam Aft
The next module would be Employee Data Specifics and Employee Privacy Laws. So this would, this would be a focus on where in the privacy laws there is actually a difference around the use of employee data and how that's treated.
[00:12:46] - Adam Aft
Then the last would really be Technology and the Laws. So what is the intersection of the future of work and the application for data privacy laws that really haven't quite caught up, or are always evolving to catch up with the way in which the technology is evolving for use of employee data, as I'm sure you see day in day out, the amount of abilities brought on by various employment cloud applications and tools, it really continues to become much more powerful how enterprises can actually use this data.
[00:13:17] - Adam Aft
I would want to really spend some time focusing on mapping out how can you actually exist in an environment where the technological evolution and the legal evolution are always chasing after each other in some way and how to best effectively operate in that environment. So it would be a fascinating opportunity and course, for study.
[00:13:37] - Doug Foulkes
But you say that's a little bit in the future, maybe?
[00:13:39] - Adam Aft
I think so. I don't expect to be taking that class any time soon, but always possible.
[00:13:46] - Doug Foulkes
Adam, thank you so much for your time joining us on the podcast. It's been a very enlightening hour, certainly for myself. And thank you so much.
[00:13:55] - Claire Haidar
Adam. Thank you so much for having us here on the podcast today. It was honesty, just such an honor to speak to you and be able to dive into that magnificent legal brain of yours. I've learned a lot from you, and I definitely know that our listeners are going to have a lot that they're going to be able to take away from this. So thank you for spending this time with us.
[00:14:16] - Adam Aft
Thanks so much for having me a great discussion and great to spend the time with you.
[00:14:20] - Doug Foulkes
And that brings us to the end of Episode 67 and our time with Baker Mckenzie, partner and data privacy guru Adam Aft, if you found this podcast of value, please share it with your friends and colleagues. Catch us on Spotify, Google and Apple podcasts. Or of course, on WNDYR website, wndyr.com. From Claire and myself. Bye for now.