Why CIOs should be thinking about clean rooms

If there is one area of IT that chief infor­ma­tion offi­cers (CIOs) will need to mas­ter this year, it is so-called clean rooms. 

These have been used for some time, most notably in dig­i­tal mar­ket­ing. The likes of Face­book, Google and Ama­zon have offered them to some of their largest adver­tis­ers in the past few years, but their use was rel­a­tive­ly lim­it­ed, in part due to cost.

This is going to change in the year ahead as com­pa­nies adjust dig­i­tal mar­ket­ing plans to cope with the loss of third-par­ty track­ing cook­ies. Busi­ness­es realise they need to be more reliant on their own first-par­ty data, but they also need to be able to com­bine data insights to under­stand an indus­try bet­ter and improve their mar­ket­ing per­for­mance.  

Shar­ing per­son­al­ly iden­ti­fi­able infor­ma­tion with anoth­er busi­ness would mean break­ing the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR), unless the con­sumer has express­ly giv­en per­mis­sion for their details to be shared. So the race is on to devel­op a means of allow­ing two par­ties to inter­ro­gate one another’s data with­out reveal­ing per­son­al infor­ma­tion.

Driving clean room adoption

Use of clean rooms is like­ly to be led by adver­tis­ers and pub­lish­ers. Brands have data­bas­es of cus­tomers and their tar­get audi­ence, while media com­pa­nies have infor­ma­tion on who vis­its their sites. Com­bine the two and, with­out reveal­ing iden­ti­ties, a site would be able to con­firm the type of peo­ple reached by a cam­paign and com­pare it with the brand’s desired audi­ence. 

A case in point comes from the Finan­cial Times, which is active­ly inves­ti­gat­ing how it could use clean rooms to build a deep­er rela­tion­ship with brands that goes fur­ther than adver­tis­ing, but would not require per­son­al data to be shared beyond the organ­i­sa­tion. Antho­ny Hitch­ings, dig­i­tal adver­tis­ing oper­a­tions direc­tor at FT.com, says it is ear­ly days, but that the com­pa­ny is inves­ti­gat­ing clean rooms as a means to dis­cov­er if some­one who saw an advert, read a spon­sored arti­cle or reg­is­tered for an event fits with­in an advertiser’s tar­get audi­ence list.

“We want to build deep­er rela­tion­ships with part­ner brands with an offer­ing that includes part­ner con­tent, webi­na­rs, round­ta­bles and events,” he explains.

“It will be inter­est­ing to under­stand how the tech­nol­o­gy pro­gress­es and whether clean rooms can be explained to users in such a way that they under­stand and con­sent to. Our approach is typ­i­cal­ly con­ser­v­a­tive when it comes to user pri­va­cy. For that rea­son, we are dig­ging deeply to under­stand the tech­nol­o­gy and impli­ca­tions.”

Shot in the arm for events

Clean rooms are also like­ly to gain trac­tion towards the end of the year by help­ing to get the events indus­try back up on its feet, accord­ing to Chris Sains­bury, founder and man­ag­ing direc­tor of dig­i­tal mar­ket­ing agency UX Con­nec­tions. He is inves­ti­gat­ing the tech­nol­o­gy as a means to enable event oper­a­tors to work with pub­lish­ers to reach their tar­get audi­ence. Whether it is a new con­fer­ence with no data­base to work from or an estab­lished event whose data needs refresh­ing, clean rooms will enable an events busi­ness to know where it can find its tar­get mar­ket.

“We’re work­ing with a new lux­u­ry yacht­ing event that has a very spe­cif­ic, afflu­ent tar­get audi­ence, but has no data­base,” he says. “We’re going to be look­ing at whether a clean room will allow us to ensure we only work with yacht­ing pub­lish­ers and per­haps oth­er event organ­is­ers who have access to that audi­ence. With­out this tech­nol­o­gy sit­ting between com­pa­nies, it’s going to be hard for com­pa­nies with­out a pre-exist­ing list of con­tacts to build up a new event.”

Use in benchmarking

It is like­ly the pub­lish­ing, adver­tis­ing and events indus­tries will lead the way on clean rooms in 2021 because dig­i­tal mar­ket­ing has tra­di­tion­al­ly relied on third-par­ty data. When walls are erect­ed around first-par­ty data, pub­lish­ers will need to find a way to show adver­tis­ers they are open­ing up their desired audi­ence. 

How­ev­er, in the longer term, any busi­ness­es that could ben­e­fit from com­par­ing data with oth­ers are like­ly to join the trend towards clean rooms. Mike Reid, chief tech­nol­o­gy offi­cer of Clir Renew­ables, explains the tech­nol­o­gy he is devel­op­ing is start­ing to allow ener­gy com­pa­nies to bench­mark their per­for­mance so they can learn from one anoth­er.

“Renew­able ener­gy com­pa­nies need to know if their instal­la­tions are pro­duc­ing as much ener­gy as they should be and when main­te­nance is like­ly to be due so they can plan ahead,” he says.

“They are reluc­tant to share data direct­ly, but by pool­ing it they can find out if, say, a tur­bine isn’t pro­duc­ing the indus­try aver­age for wind con­di­tions, per­haps because a sen­sor is faulty and it isn’t being direct­ed into the wind prop­er­ly. The com­pa­nies are also able to see the mechan­i­cal per­for­mance of sim­i­lar tur­bines so they can get a good idea when main­te­nance is going to be required.”

Security and privacy concerns

If this trend is ring­ing secu­ri­ty alarm bells for CIOs, it is for good rea­son. There are poten­tial legal prob­lems but, accord­ing to data pri­va­cy lawyer and part­ner at Lin­klaters, Georgina Kon, the key is in the tech­nol­o­gy. There are sev­er­al options, but she believes the best way to avoid GDPR infringe­ments is to allow com­put­er data­bas­es to inter­ro­gate one anoth­er, pos­si­bly by arti­fi­cial intel­li­gence, but only take away “high-lev­el” learn­ings that do not reveal any iden­ti­fi­able infor­ma­tion.

She also cau­tions that CIOs need to think beyond pri­va­cy laws to ensure clean rooms are only built with rep­utable part­ners. “Our clients will look much more wide­ly than just the GDPR,” she explains. “They will also be think­ing about issues such as con­trol of the under­ly­ing data, con­fi­den­tial­i­ty and pro­fes­sion­al secre­cy.”   

This need to pro­tect data beyond GDPR and ensure both sets of data are legal­ly com­piled and strong­ly pro­tect­ed is going to be vital, accord­ing to Andrew Bar­ratt, man­ag­ing direc­tor of data secu­ri­ty busi­ness Coal­fire. He is active­ly inves­ti­gat­ing build­ing clean rooms for clients, but advis­es busi­ness­es to pro­ceed with cau­tion.

“Put two sets of data in the same place and you have a poten­tial trea­sure trove for an intrud­er to plun­der,” he warns.

“Then there’s the issue of how clean the clean room can actu­al­ly be. There may not be a prob­lem with your own data­base. The real issue is who you’re going to let into a clean room. You just don’t know where some­one else has got their data from. It’s a lit­tle like hav­ing a sparkling kitchen floor you let some­one else walk on with­out know­ing whether or not their boots are mud­dy.”