Article 14. External data - use with care

Spoken (by a human) version of this article.

Banks and insurers are increasingly using external data; using them beyond their intended purpose can be risky (e.g. discriminatory).

Emerging regulations and regulatory guidance emphasise the need for active oversight by boards, senior management to ensure responsible use of external data.

Keeping the customer top of mind, asking the right questions, and focusing on the intended purpose of the data, can help reduce the risk.

Law and guideline mentioned in the article: 

• Colorado's External Consumer Data and Information Sources (ECDIS) law 
• New York's proposed circular letter.

About this podcast

A podcast for Financial Services leaders, where we discuss fairness and accuracy in the use of data, algorithms, and AI.

Hosted by Yusuf Moolla.
Produced by Risk Insights (riskinsights.com.au).

Episode Transcript

(00:00):
This article was published inNovember 2024 and it's titled
external data use with care.
So the background to this isthat we've seen few situations
recently where Externaldata has been used without
justification or used for apurpose other than the original

(00:22):
intent of the external data.
And so just wanted to talka little bit about that and
what we should be doing toprevent that from happening.
So here we go.
Banks and insurers rely onexternal data in serving
customers and making decisions.
Sometimes these are useddeliberately with care in

(00:42):
line with the purpose forwhich they were collected.
Other times, they are throwninto the mix because they
are on hand and seem toimprove model performance,
but not in alignment withtheir stated purpose.
Regulatory signals.
We've explained previouslywhy we shouldn't wait
for specific legislation.
There are existingregulations that cover bias,

(01:05):
anti discrimination, etc.
But specific laws andexpectations about
responsible use ofexternal data are emerging.
Colorado's External ConsumerData and Information
Sources Actis Law.
And New York's proposedcircular letter highlights
a growing focus on potentialbias and discrimination that

(01:26):
stems from inappropriateuse of external data.
And we'll put linksto both of those,
The details vary between them,but both expect active oversight
by boards and senior managementto ensure that external
data is used responsibly.
Other regulatorsmay follow suit.

(01:47):
An analogy fromanother industry.
Let's consider a well knownexample from the pharmaceutical
industry that might be helpful.
It is certainly not foolproof,but we can learn from it.
Pharma has strict regulations,for example, medication package
inserts, Provide informationabout a drug's composition,

(02:08):
intended use, potential sideeffects and contraindications.
These providers and patients.
Promoting safe usage andinformed decision making.
Applying this to external data.
Imagine if external data camewith similar data inserts.

(02:29):
These could include detailedinformation about Data
composition, so where thedata originates, how it was
gathered, privacy practices.
Intended use.
Specific purposes for which thedata is designed to be used.
Potential biases.
Acknowledgement of anyknown biases in the dataset.

(02:50):
So this would be similar to sideeffects in the case of drugs.
And validation methods.
Description of how thedata has been tested for
accuracy and fairness.
Intended use.
As an example, some externaldata is intended to be used
for marketing purposes.
They can, for example,help target segments of the

(03:12):
population that our productsand services will suit.
There are considerationshere, of course, like making
sure they align with designand distribution obligations.
But marketing is the purposeoutlined when we get the data.
In medical terms, this mightbe like a prescription.
But let's say we use thedata for a different purpose.
For more information, www.
FEMA.

(03:33):
gov pricing for example.
demographic segments.
So using it for pricing canresult in discrimination,
This could then be likeprescription drug misuse.
Using medication for apurpose other than for
which it was prescribedcan be seriously risky.

(03:57):
The same can hold truefor using external data
for a different purpose.
Protecting against misuse.
We don't, yet, have consistentexpectations for external data.
The new Colorado law and NewYork guidelines will help
for those jurisdictions.
For everyone else, existinglegislation still applies.

(04:20):
Even if they're not thatspecific, we must protect
our customers using thedata safely and responsibly.
To achieve that, here are somequestions that we can ask.
Some of these mightappear to be repetitive
and this is deliberate.
So we ask ourselves, sothat's leaders or ethics

(04:41):
committee members, thefollowing five questions.
And this is obviouslynot exhaustive.
Number one, are we awareof all the external data
we are using and where?
2.
What will our customers say ifthey know what data we are using
or what we are using it for?

(05:01):
3.
Have we clearly disclosed tocustomers that we use external
data and where we use it?
4.
If a customer wants tocontest the decision that
used external data, arewe adequately prepared?
5.
How can we educate our teams toprevent misuse of external data?

(05:24):
We then ask datascientists and developers.
1.
How are we using external data?
2.
Are we using the databeyond its intended purpose?
3.
Have we used databecause we have it?
4.
Have we used data becausewe noticed a correlation?

(05:48):
5.
Do we have approval foreach flow or model or
algorithm we have used it in?
And then we ask data providers.
1.
What is the purpose of the data?
2.
What should thedata be used for?
3.
What should the datanot be used for?

(06:09):
4.
Has the data been tested foraccuracy and fairness or bias?
And 5.
How has the data been collected?
And does that maintainprivacy obligations?
Responsible useof external data.
continue to do so.
We need to approach it withcare, keeping our customers

(06:31):
protected and complyingwith our obligations.
It starts with asking theright questions and always
keeping our customersbest interests in mind.
That's the end of thearticle, thanks for listening.