Author Archives: thedoctor

GDPR and non-EU Spend Analytics Providers … Mortal Peril? (GDPR Part III)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

While there has been much debate within EU countries around the preparation for GDPR on the 25th of May, the level of knowledge and preparation for those suppliers of analytics platforms and services outside of the EU remains largely an unknown. Controversially, our assessment is that many customers/suppliers will have ignored it and assumed that it doesn’t apply.

If your spend analysis provider is a large, well-known brand name with a global presence, it is highly likely that they will have opted for the binding corporate rules option. This is a complex and intricate process but is essentially a means of larger data service/analytics providers applying to the EU to establish the provision. The supplier applies a BCR to one of the EU Supervisory bodies (one of the 27 EU members). These are termed Lead Authorities. Once the checks have been completed and the Lead Authority is satisfied with the adequacy of the data privacy safeguards in place, the Lead Authority decision is binding across all Supervisory authorities in other European states. However, as in much European Legislation member states may have additional requirements.

Once Binding Corporate Rules (BCR) status has been achieved:

“Binding Corporate Rules (BCRs) are designed to allow multinational companies to transfer personal data from the European Economic Area (EEA) to their affiliates located outside of the EEA in compliance with the 8th data protection principle and Article 25 of Directive 95/46/EC.”

However, what of smaller providers? No so easy – and it can become rapidly more complex.

The EU has two other provisions for managing data that contains personal information – the rule of adequacy and safeguarding.

Not surprisingly (shock) all 27 EU members meet the rule of adequacy. Adequacy is simply defined around the level of protection at national level.

For other countries who are non-EU, the EU will judge this on the national rule of law; respect for human rights, fundamental freedoms and relevant legislation, both general and sectoral, including public security, Defence; National security and Criminal law. Simple enough …

Now the bad news. There are only some 11 countries globally that are deemed to meet this level of adequacy. These include Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay. If your spend analysis provider lives in any of these countries – that’s fine. Happy days.

However, what if they don’t? The new Regulation is simple in objectivity. The GDPR change removes a controller’s (or data owner, we will explain controller and processor in the next few posts) previous ability to transfer personal data outside the EU where this is based only on your own assessment of the adequacy of the protection afforded to personal data. More work to do.

This brings us to the last option – safeguarding.

Safeguarding means just that – can the supplier offer sufficient safeguards with data containing personal information?

However – can the problem be eradicated and avoid GDPR regulations?

We will cover these areas in the next post. Our advice as always – find a lawyer who understands the regulations and can guide you either as a customer or supplier. If you are in doubt, get advice.

If you breach the regulations – it could get expensive.

Thanks, Tony.

Maybe You Can Be a Procurement Hero!

Everyone wants to be the corporate hero, but at the end of the day, very few people in a company get to be society’s hero, and fewer still without blowing the whistle on criminal activity (and being made the target of a well paid hitman).

But if your company is big enough, and the spend you’re responsible for is large enough, you can sometimes do the right thing for the company and the right thing for society (even if it’s a bit tough at first).

How? You get corporate buy in to use your corporate spending power for good. You get commitment that it’s not just the lowest cost, it’s the lowest sustainable cost that meets minimum ethical guidelines. You get a commitment from the C-Suite to not only do your best to follow what is becoming the law in many jurisdictions and eliminate slave, forced, and child labour from your supply chain but to do it because it’s the right thing. Then, you can also get a commitment to shift at least some supply to suppliers that are making efforts to be more sustainable (and not polluting the local water table) or corporately responsible (and making efforts to improve the quality of life of their workers or the local community). In certain categories (primarily sourced from low-cost countries), each of these options will generally be a bit more expensive in the short term than going with the lowest cost supplier, who likely underpays the workforce or destroys the local environment, but well worth the temporary cost increase.

First of all, your C-Suite won’t have to worry about criminal charges or jail. Secondly, sustainable suppliers tend to be around for the long haul and get more leaner, more productive, and more cost effective over time — especially with your investment (and work with you to contain costs when they start to rise). Third, you can market the heck out of your commitment to sustainability and corporate responsibility. While not all consumers will pay more, some will, and those that are willing are those that will stick with you. Plus, when your competition stocks out because their supplier is finally shut down for its poor practices, you won’t have any disruptions.

Now, you’re probably saying one buyer can’t make a difference, but if you are buying a multi-million, or hundred million, category for a Fortune 500 / Global 3000, that’s a lot of money and you can use it to make a huge difference. No supplier wants to lose out on that amount of money, and even current suppliers can be changed.

Plus, if you band together with peers that are part of a trading network (like the Ariba Network that does more commerce annually than Alibaba, Amazon, and eBay combined) and all make a commitment to stop buying from a certain supplier until they adopt certain minimum corporate responsibility and sustainability requirements, you can bet that supplier will turn on a dime.

The reality is that if Procurement gets a Purpose in the Global 3000, and practitioners can garner the resolve to stick to their guns, they are one of the few people who can make a difference in this corporate driven world. It won’t be easy, but is anything worth doing?

For a slightly deeper dive into Procurement With Purpose, check out the doctor‘s two-part series over on Spend Matters (Part I) and for a much deeper dive, check out the public defender‘s new paper on “Procurement with a Purpose — Making a Positive Impact on Organisations, Human Rights and Communities”, sponsored by Ariba.

GDPR and Procurement Spend (GDPR Part II)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

It’s interesting that the more companies you speak to, the less certain you become about whether organizations have truly readied themselves for GDPR.

There are statistics around how companies in general are prepared for GDPR. The focus in most organizations is on the most obvious areas of a business – marketing and customer data. The Regulation is very specific around what is meant by personal data:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Well, spend doesn’t contain personal data … does it?

Be afraid, very afraid — spend data can be packed with personal data.

The Regulation states that in-scope data is:

Personal data that is processed wholly or partly by automated means. – Personal data that is part of a filing system or intended to be.

The only exclusions are things like immigration checks, police investigation, personal activity and personal data generated by an activity outside of EU Law.

So, should sourcing and procurement be worried? I would say yes.

In most company data sets within the EU there may be:

  • Staff reimbursement data – many companies still pay staff by setting them up as vendors;
  • Purchasing or corporate card data – many companies use an expense manager. Each card will have a name associated with it;
  • Many invoices will have line descriptions with components like consultant names, “James Smith, managing consultant”;
  • Temporary labour – the name of the person, rate and other details may be included in the invoice text.

There may be a lot more personal data across e-procurement and other data sources. Data inventory analysis is designed to identify those elements … assuming that someone has realized that spend data may contain personal information.

However, does it matter? We would say yes. A name in this type of data identifies a person very quickly. We even know who James Smith, our consultant, works for. Vendor name of course.

If you are not moving the data outside of your own environment (within the EU), the risk is reduced – but there are several elements to consider. However, if you have a spend analysis provider outside of the EU then the problems are suddenly more acute. Our guess is that many of the larger analytics providers will have scrutinized the Regulation and accommodated the required changes already.

For many smaller providers that service European clients from outside of the EU, recognition of the legislation complexities may not have even started.

The Regulation goes live in under a month. The question is – do European clients and analytics providers both inside and external to Europe have the right level of compliance – and understanding of the obligations? They aren’t optional either.

Perhaps it’s time you asked your provider if you are an EU company.

In the next article we will look at some of the complexities of spend data that sits in the GDPR domain. Part of the reason the GDPR legislation has been introduced is to fundamentally change how personal data is managed.

This isn’t a “nodding dog” legislative change – of that there is little or no doubt.

Thanks, Tony.

Ariba Live (Europe) Needs a Mascot

SI recommends Kitty Purry!

First of all, it’s a cat. Secondly, we know that Kitty Purry likes Katy Perry music. And given that every time the doctor walked into a general session, it was Katy Perry song that was playing, it just seems like the right thing to do. After all, Kitty Purry loves to ROAR!


 

Get With the Program!


Sourcing only identifies value. But value is not realized until it is captured. Capturing value requires each purchase to go through the system and be realized as a perfect order — the right product at the right place at the right time for the right person at the right price using the right delivery method, and so on. In order to make this happen, an organization has to do more than source — it also has to execute, track, report, and correct. Otherwise, it will fail to realize 30% to 40% of negotiated value (which is a statistic that has been well known for almost a decade).

However, the only way an organization can properly source, execute, track, report, and correct procurement operations is through proper program management, which is much more than just executing an event, negotiating a contract, and filing it away in the contract management system. It’s taking that e-paper and making an e-process out of it, preferably in an integrated Source-to-Pay platform that can insure each step of the program is followed.

This requires a program-management based platform, something which the average Procurement organization does not have as most first, and even second, generation sourcing platforms did not have any real program management built in.

And when one thinks about what is involved when one tries to consolidate the messy and muddled functionalities scattered across the ERP, analytics, invoice processing, contract management, supplier management, and other supply management platforms across the organization, supply program management can be a difficult and complicated task. The solution of which is an effective program management strategy, backed up by an appropriate platform-based solution.

To find out how to get started, download the doctor‘s latest white paper on “The Importance of Program Management For Savings and Value Realization”, sponsored by SynerTrade. The read will be worth your time.