E22 - Sanna Toropainen – Co-Founder of Muna.io
Sanna_Toropainen - 3_24_21, 6.26 PM
Thu, 3/25 2:39 AM • 41:35
SUMMARY KEYWORDS
data, companies, consumers, privacy, people, transparency, EU, creating, question, exchange, customers, sell, Belgium, individuals, sanna, peanut butter, direct link, monetization, consent, data protection
SPEAKERS
Debbie Reynolds, Sanna Toropainen
Debbie Reynolds 00:00
Personal views and opinions expressed by our podcast guests are their own and are not legal advice or official statements by their organizations. Hello, my name is Debbie Reynolds. This is "The Data Diva" Talks Privacy podcast, where we discuss privacy concepts with industry leaders around the world with business information that businesses need to know right now. So today I have a very special guest on the show. Is Sanna Toropainen correct?
Sanna Toropainen 00:35
Yes.
Debbie Reynolds 00:40
From Brussels, Belgium, she is the co-founder of Muna.io. She is a private data protection expert, and Sanna and I had the pleasure of meeting on LinkedIn, where she reached out to me, and it was really cool because you wanted I don't know what I had done or something. And you had contacted me about doing an article about data monetization. And so we've done a couple of other things since then. So I think you've quoted me in a couple of things. And I really love the article that you wrote, because the article almost starts out like a book or something. Oh, you know, so great day in Belgium, whatever. SO it was really cool to see the way that you have written that article, but I would love for you to introduce your company and some of the things that you work on, so the audience can get a more fulsome picture of you on the things that you do.
Sanna Toropainen 01:52
Oh, thank you. Yeah, sure. Well, first of all, I'd say I'm very excited to talk to you again. And thanks so much for having me on this podcast. I was very excited when you reached out to me and asked if I would be available for this podcast, so since I reach out to you, I've really enjoyed our conversations every time we get together, and you're kind of like my first LinkedIn friend, in a sort of professional way. I've been so excited to follow everything you do, and you always are putting forth very interesting and very timely topics when it comes to privacy. So it's very, very exciting. And I was just actually listening to your podcast with Olga Kislinska. And it was so well, and she was talking about this constant. And when it comes to that, finding the middle ground between the company and the consumer. So I think what we're going to talk about today is going to be a good continuance for that. So now about myself, so I'm actually originally from Finland. But I've been here in Belgium, for about five years I, originally I've been to, at first I went to the Netherlands, and I studied my legal degree there. So I studied comparative law and EU law. And while I was studying, I also worked with a property law professor, who was very, very into the question of can data be an object of property law. Can you own data? And it was really through the work with him that I got so involved in the question of data ownership and then subsequently the question of data monetization. So after I finished my studies, I started to work on my own startup called Muna.io. And what we do is really enabling individuals to exchange ideas, exchange their data, with companies in exchange for cash or discount. So we are creating an application that has a Tinder kind of like interface, where you swipe through offers. And that offer comes from the company. And what he says is, what kind of data the company wants, you know, it can be just as simple as a name, email, and a postal code, and what you get in exchange. So for example, a 10% discount on the product the company is selling. So what we want to give to consumers is this transparency and value exchange. So transparency, what data the company gets from you, and what purpose the company uses that data, and that you get something in return, whether that's discounts or cash or like that. So we've been working on this. We started last year, really full-time. But obviously, we did a lot of background work before that, and we want it to have our pilot. So last year was meant to be a really big year for us to have a pilot with companies like airlines and hotels and consumer goods companies. But like most of us, 2020 was a challenge. And we had to postpone the pilot because a lot of the companies couldn't run their business anymore, like travel companies, and so forth. So now 2021, we are hoping to do the pilot where we can work with companies that are putting offers on our application and then get to have consumers exchanging the data. So that's what the company's doing at the moment. And, yeah, maybe a few other things about my background. So yeah, I've been really focusing on privacy and data protection questions. I also worked with Belgium, a Telecommunication operator, with their Cybersecurity covenants. And before my legal studies, I also worked with HR and NGOs—actually, my first studies was social services. And somehow, from social services and social work, I got into HR from HR into law and data protection. So I do sort of come with this very social view, helping individuals. So yeah, I think that's quite interesting.
Debbie Reynolds 06:48
Yeah, yeah. Data monetization or people data ownership is such a hot issue because people, just like you're saying, from the social perspective, people have very deep feelings, you know, one way or another regarding kind of data ownership and data protection. I think one thing I would love to talk to you about or get your opinion about is sort of the opinion or the feeling in Europe, about data, maybe being so different from the way that we feel about data in the US, you know, part of that is the privacy being a fundamental human right, in Europe, where it's really not that way in the US. So give me your thoughts about kind of those differences.
Sanna Toropainen 07:42
Yeah, well, it's definitely a topic that raises a lot of opinions. But I think that there's also a lot of misconceptions when it comes to it. And that's like, one of the misconceptions is that when you sell your data, you lose your right to data protection. And this is something that if you talk with if you talk here in Europe, to an expert, and they are of this opinion, then obviously they'll be saying like no like data should like you should never sell your personal data because it because it's a human right, privacy is a human right, and you can never give away your human right. Now. This is what's the problem. The problem in this argument is that it is actually not true because when you exchange your data, you are not actually selling your human right now. The problem here is that or why people get confused is because when you sell something you sell you you sell something you usually oh like you own a car. So you sell your car. Now, the right to property is a transferable right. And once you transfer it, you no longer have the right to it. Human rights are not transferable. So you can never transfer away from our right. And if you try to apply these two concepts, data, you get this idea that okay, now I'm giving away my right to privacy. However, data is not an object of property law. There is legally no such thing yet, as data ownership. So when you sell your data, you don't do it as if you would sell your car because you cannot. You don't have a property right to data. But when you make a contract with a company that you can process my data with my consent, you are within the realm of the GDPR. And if you in the realm of GDPR, and you give consent to a company to process your data, you are you. You have a contract with them. And the company respects your right, and then you still have the right to revoke your consent. You have the right to ask for deletion. So nothing happened to your right to privacy. And this is one of the core issues. Why in Europe, when we talk about data monetization, from a personal point of view, there's a lot of emotions involved.
Debbie Reynolds 10:27
Right? Yeah, because I know a lot of my European friends, because we talk a lot, and we're very passionate about privacy being a fundamental human right, and being something that can't be sold, which is true; it's not like a property right where you transfer it. I don't know, I think, almost like there was a Simpsons episode many years ago about Bart Simpson selling his soul to someone. So that's, to me, I sort of think of it that way. Like, you really can't sell your soul really sorry, you really can't sell your, your right to privacy. But I think the thing that they get, that people are concerned about is like if I let my information out there, what happens to it next? Like, you know, who else looks at it, and so, I'm glad for the GDPR, you know, has been a model for other countries about sort of our transfers and consent for, you know, for data use is really, really key. So that's something that we don't have here in the US to a great extent, except for laws, like, the CCPA, where they're saying, if you give your data to a company, for one reason, you know, they need to let you know, they're going to sell it somewhere else, or if they're gonna be able to use it for different reasons. So that one of the really big things is sort of created these, you know, multi-billion, trillion-dollar companies, because once they got certain data, they could do almost whatever they want with it. What are your thoughts?
Sanna Toropainen 12:10
Absolutely, I am all for this transparency. And this is one of the key reasons why I'm working on Muna.io because I believe that when we bring more transparency, not only the way data is being processed by the companies, but to the value transactions that the company or you are making. So you know, you get these examples from us. But we also have to say examples from the EU. So we have Carrefour is the French supermarket brand, they also have a bank. And what they do is that they take their data they get from the customer's actions, and they sell that as analytics to companies. So essentially, this is a new revenue stream for them. Now, just recently, they were, they get like a 3 million fine from the French Data Protection Authority for not respecting the GDPR. So this means that they haven't been fully transparent also towards their consumers on what happens to the data that's been collected from them. And what I would like because I use Carrefour in Belgium all the time and not, and I'm not comfortable with the fact that I, I'm helping this company to make more money, but then what's coming to me because the prices are still the same as if I will go to the other supermarket. So there's no, there's a lack of transparency also in how the value is being created with the data. And I think that when we are able to have this more direct link between the company and the consumer, then there's also more transaction transparency. Parents see the value exchange. What I mean by that is, when I give one of the biggest, let me put it this way, like when you talk about personal data monetization. Next to the question of the legal consequences. The second question is, how much is my data worth? Right? On? A lot of objections. Come on, say okay, well, my data is worth nothing, or it will be just like two cents a month, or just a minimal amount that would not make sense for me to sell data. And a lot of other startups have been doing this kind of data with an association. What they do is that they collect data from individuals, then aggregated and anonymized it, and then sell the analytics. And obviously, if you have, let's say, 100,000 consumers that gave the data, and then you sell one product, and then you need to take take the profit from The one product and divide with 100,000, that it might be a lot per person. And this also comes next to the value. How does it make you that you don't get a lot of money for your data? What I would like to see is that what's the real benefit? If I give my name, email address, and other personal details to the supermarket that is able to then part market me things on I buy more from them, then there's actually that direct link and then transparency on okay, what was the value I helped to create? So, in this way, my data can actually be valued at 10 euros, so the company is ready to pay me 10 euros if there's a direct link without this aggregation, optimization, or so forth? I'm not sure if I made it if I was a bit going different places with this answer.
Debbie Reynolds 16:01
No, that's really good. I feel like a lot of people who are against data monetization, you know, it is inevitable. This has to go this way. Because once you have transparency, people see what their data is worth. The next question is, why can't I benefit from it or, you know, for me, I don't necessarily want to monetize my data. I would love to see what my data is worth to other people. Because obviously, these companies are making billions of dollars on this data. And I feel like a lot of it is they say, well, we take your raw data, and then we make something new with it. So our investment and creating the systems to make something new, you're not going to benefit from that. So we're just going to say, you know, we'll give you $1 or something for x, you know, whatever it is, but I feel like now with so many. I like to call it a trust or so with things like Apple, being able to give people transparency, and it's really forcing people to consent or understand what is happening with their data. People are more, you know, careful, you know, we're kind of stopping and reading these things because I get those on my phone where I have an app, and it says, Do you want to share all your photos or just certain ones? And I have to really think about that. I'm like, do I really want to have all my info. So the fact that it's really having you stop and ask those questions is really important. But the flip side of that is the next step. And that is, you know, now I'm more selective with who I share my data with. And these companies, some companies are going to get shut out from data sharing because I may decide, I don't want to really trust you. So the next thing is, how do those companies get data if I don't want to share it? So they're gonna have to try to entice me in some way to come back to them and share my data. So it has to be monetary, something right, you know, some type of discount, some type of wanting some type of benefit. And I feel like, in this way, we have just a way to, you know, the Data Services Act, you know, I, whenever I see any articles about data monetization, I always send them over to you. Because I'm like, oh my God, and most pharmacies really like looking at this is the issue, and I want to make sure you understand that, you know, make sure those things are things we can talk about. So this has been a little bit shocking to people that the Data Services Act where Europe is creating their data strategy, and part of this data strategy is creating a way for companies in Europe to be able to get data that maybe they would not have otherwise been able to obtain about consumers for either research or even commercial purposes. What are your thoughts about sort of that push? I feel like a lot of people felt like, Okay, well, GDPR, such a strong law is about personal rights. And then when they saw this kind of Data Service Act come up, and you're like, wait a minute like you're putting my data into a database for other people to see, you know, how can we reconcile those two things?
Sanna Toropainen 19:39
Yeah, I've really mixed feelings about like, on the one hand, I'm super excited to be in Europe at this moment where you have the new data strategy that is, it now recognizes that you have these data intermediaries like what Muna.io is, that can help consumers to get the benefit from that data. But then, on the other hand, your data strategy is really meant to serve the companies and governments to have more data. Because you recognize this, that when companies have more data, they can make more profit, and that's what we want to have a booming economy. You know, you cannot have a lot of technical advances, advances, for example, with AI if you don't have enough data to train the AI on. So a lot of SMEs and other companies don't have that kind of access to data that they would need to do a data-driven innovation yet. So EU wants to really create this kind of place where companies would have access to this data. And I'm all in for this. But then, as you were kind also pointed that sort of question list, I will give does this happens at the expense of the consumer then? And this is also where I would like to, again, a call for that transparency? And how do these companies where they get the data? And how is then that data being used? And I would say, okay, well, let's then go to these data intermediaries like the US also, now, just in November, I came up with this Data Governance Act where it is putting this sort of, okay, we have, let's put some rules for this data intermediary is that they really stay neutral, that they don't trust, like, become, they don't start to misuse the data they get from the consumers and, and so far, they're still very, very light rules, but at least acknowledge that so far, EU has been kind of shying away to even take a real standpoint on personal data within minutes. Annexation is more just always been talking about, okay, companies monetize the data. So why do I have these mixed feelings is that on the one hand, the EU is doing this work to acknowledge and bought some rules for this data intermediary that can help consumers to give data to companies but get something in exchange. But then, on the other side, they really want to sort of give a lot more to companies. I don't know if you see what I mean. But what I really am trying to say sort of that if you just only focus on the companies, but then you don't ask how the companies deal with the data, you get these examples like the Carrefoure. They are creating new revenue streams from the customers, but then there is a lack of transparency into how the value is being created. And then subsequently how the data was used or how the data protection rights of the consumers were respected. So you just want companies to like how much more money you want companies to make with this data that they can get from the consumers? You know, because if you talk about data monetization, the first thing you also data when it's in the station itself simply refers to the way a company can either externally or internally make more money. It's not about rituals. So if you always sort of, are you more for the companies or more for the consumer? That's always sort of my question. Okay, the EU wants to just show that, yes, obviously, we are human-centric, and we are, you know, human rights go beyond everything else. But then the only one, but so that's one, one point. And then the second point, but yes, we actually want as companies to make more money with the data from the consumer. So I think that there's a bit of a clash there that the EU is not really clearly pointing on what's the other I don't know, the tension between like, the Human Rights approach, and then companies making more money with data.
Debbie Reynolds 24:11
Right? I think that. So around the time that the GDPR came out, the working group that puts out their recommendations, they have put out a letter about innovation. So the letter was saying, you know, we do want a strong rise for individuals. But then we also understand that businesses need data, and we don't want to stifle innovation. So I feel like a lot of the things that the Government Act and, you know, the data strategy is about understanding that the GDPR has, in some ways, had a chilling effect, where companies are afraid in some ways to use data in certain ways. So they're trying to navigate their way through that, but it is true that companies do need data. You know, I had a podcast recently with a gentleman who's our strategist. And he was talking about the challenge of getting data sets about cities, you know, to do studies and things like that. And it's like, if you're not like a very well funded company, you know, you probably, you know, let's say, let's say you use Google or something. So you made all these agreements with Google about or shared your data. But let's say some fledgling little company came up to you and asked you can we have your data, you probably say no way, like, I don't know who you are, you know, so we be able to have companies that don't necessarily have the market power, to be able to have data, and we reuse certain ways, I think, is, is an issue. And as you know, when I look at the act in terms of being able to have companies have more data, it seems like it's something that's happening around the world. So Europe is not the only country that's looking at doing something like this, where you have, like some, some system where people can come in and search and use data, not necessarily replicated, and take it into their environments and do other things with it, but being able to find a way to have people have access to data and also have a, you know, respect for the rights of individuals, I think, this is kind of what they're trying to do. And it's, you know, I like the fact that Europe is trying to. You have to start somewhere, right? So being able to have other countries really see how this is gonna work out, I think, will be interesting, because I think, you know, again, monetization is inevitable in some way. I told someone recently, like, I would pay for them not to sell it, like almost. Yeah. On the flip side, it's like, No, I don't really want that followed or something. So maybe that's another way. Maybe they, you know, companies can make money by saying, you know, we'll protect your data and not sell it, you know, so I don't know.
Sanna Toropainen 27:22
Exactly. I mean, that's what I would like. I would love to see that Muna.io and other companies alike can be the access point to companies for that data. And that this also comes when we've been talking to companies about our idea, they're very interested because they see that, okay. Wow, I mean, that's a transparent way to be connected to your customers. And they thought, because we work through offers, they also see, okay, well, we kind of do your marketing. And I mean, because the white, especially smaller enterprises, one data is for marketing. And if they can sort of, if they can already start doing that, and get data from the consumers who are interested in them, then they are, they are creating this kind of this loop where the data is really pointing to that purpose that they want it they don't need to go into, okay, let me scrap the internet. And let me do some shadow profiles. And let me sort of try this in all these different ways to understand what was the consumer segment that actually likes our profile. So what we want to offer is transparency, many levels. So first is how the data is being collected, where it has been used to start from there so that companies can have an easy way to access data and to also respect the rights of the consumers. And when so, that's what from more from the marketing perspective. We also talked to manufacturers of consumer goods, who don't have a direct link to consumers. So they also have the interest to have a channel like our company, to the consumers there, they wouldn't offer made necessarily discounts for their products, but some cash rewards, to be able to get a bit more a better understanding of what kind of customers would be interested in their products and how to do the product development. And this is for them a way to get that sort of like market research kind of tool and get that data that is is of better quality that is transparently purchased. So they don't need to go to these big data brokers, where data sets of anonymized data and so forth. So yeah, I see really what data intermediaries can be. Is that a way for companies to get access to data?
Debbie Reynolds 30:06
Yeah, I feel like, you know, I feel like we don't have control right now of our data. Right. So these data brokers take fragments of information that they know about us, and they try to make assumptions about us. And some of those things can be wrong. And the fact that we don't even know what they are is problematic. So an example I gave is someone, let's say, you like peanut butter, and you know, like, so say, you entered a contest, and it had peanut butter or whatever. And maybe that's one of the only things they know about you. But it because that's the only thing they know about you. It has an outsized value in terms of the way that they profile you so that maybe they say, Sanna, that's her favorite peanut butter, her favorite foods, that's the only thing we know about her, whatever. So that's not correct, right. So I think that the way that the world is probably going is that people will want to sort of cultivating their personas, probably on the internet, and also try to decide what they want to share what they don't want to share. Do you feel like you know, some people feel like oh, my God, like I this is overwhelming, and we can't achieve this right now. But I don't think that's true. I think that we can come up with a way you know, it, I think it would also benefit companies as well, where we're choosing what we share with them, and then the information that we share is more accurate, maybe than their assumption. What are your thoughts?
Sanna Toropainen 31:46
I mean, absolutely, I agree on everything with everything you just said, like, that's my absolute my view on it, that companies will benefit from having access to quality data. I mean, first of all, they don't need to spend so much energy and money cleaning data sets or trying to understand from data sets what their customers what do they want, and so forth, or putting energy into having these different ways of, like I said, following consumer behavior in online when they can just starkly be having access to consumers. And what is also important to remember that companies want a continuous relationship with their customers, they don't just want one of you, and they want to know what, when is the next time you kind of buy something, because usually when they get the information, for example, they are tracking how you read their newsletter, which clicks you're looking clicking and as such, so that is actually when they're analyzing the data that's already passed information for them, or went by that and so forth. So there's this problem for companies at the moment, they don't really know what the consumers want. And when they want it. And when they know it, they know it too late. So there's a huge benefit for companies to have a link with their customers where they could get more relevant data and more real-time data that comes when the consumer can say so they companies, they don't mind if they get fewer data. We said that, okay, I'm going to choose what I show the company and what I don't show the company, and then based on my conversation with companies that completely fine with this, they want to encourage that, because then they know that what you give to them is the real thing, right? So that when they when, you do come and tell them that you like peanut butter, then they like okay, well, now I know I can show it to her. Try to be like, okay, let me just show this ad for you like for a month, and maybe at the end of it you get it, or you look at the ad for 10 seconds more.
Debbie Reynolds 34:04
Right? There is an alliance called a Phyto Alliance, which is FastId online. And what they're trying to do is try to move towards a situation where people get past or away from passwords or try to create ways when people can connect to services with less friction. So more accurate and less friction. And one of the stats that that organization likes to tout is that the average person has about 90 usernames and passwords to log in to services. So basically, you think about it, we're all sort of sharing fragments of ourselves all these different companies, and it's hard to it's like impossible for you to like manage your privacy settings. You know, you versus 90 different companies, right. I feel like it's inevitable that it has to be a situation where the person owns their data and then or has more control over their data. And then instead of them having to go to the company, the company has to come to them to ask for their access. Because, you know, this is just is it sustainable to do it in the way that we've been doing it in the past? What are your thoughts?
Sanna Toropainen 35:27
No, yeah, absolutely. And I'm going to so this ties into the previous comment about the quote from Namo, from the consumer point of view that when I talk to then to a lot of consumers, or just, I constantly want to have this to talk to people about what do they think about their privacy? So I have some people online that I'm asking, okay, so how do you feel? Do you care about privacy? And tell me like, well, maybe that's what I mean, I know, I should care about it, but I don't really do anything. But then when I ask them, for example, so how do you feel when you're browsing the feed, and you see an ad, then you always have the stories like, oh, you know, just yesterday, I was saying to my friend that I want to buy this bag and then consider I go online, and I see this bag, and I'm 100% sure that listen to me. Yeah, I always get these stories. Some people do care. So I'm happy to be here because I want people to care about privacy to be very, to become more active. I mean, I know it's difficult like you said, I mean, that's like, we have so many different profiles. And it's really difficult to manage it. But that's where we need this kind of tool. Kind of intermediaries will help us to control the access. And that's also what he wants, and is putting in the strategy that okay, yeah, we realized that it is difficult for consumers at the moment to use the data protection rights, because it's, it's just sort of, it doesn't really fit into the user interface. Many of you are right here on a daily basis. But that's where you need different kinds of solutions. Yeah, so did that answer your question?
Debbie Reynolds 37:16
Yeah. But yeah, definitely, definitely.
Sanna Toropainen 37:20
It's like one thing, you can think about one thing, and then you know, there are so many things I want to say. So I'm always kind of like, trying to,
Debbie Reynolds 37:27
Well, you're, covering it. You're doing a really good job of covering this. So if it was like the world according to Sanna and everyone does everything that you say, what will be your wish for, you know, data privacy, either in the EU or around the world? What do you think we need now that we probably aren't thinking about or aren't doing? Well,
Sanna Toropainen 37:51
To me is really just having this conversation, a loud conversation about well is what are those value exchanges, we can have those by supporting startups, lesser startups, like, like mine, but also the 100, others that are out there are doing the same kind of work trying to provide news when individuals use the data protection rights. So I think that there are loads of good ideas and lots of people working with brilliant solutions, and we need to support those and so that individuals can have a variety to choose from. And then with that work, eventually, a redundancy that's fine. Those weights go sweet. We have many different challenges, here we have kind of legal challenges, but even more, so we have that UX UI challenge on how to incorporate privacy into our daily life so that it is really instantaneous and easy and fun to do. So that we don't need to compromise with our privacy, the good offers? And the sort of the convenience.
Debbie Reynolds 39:04
Yeah, I think, you know, it is about choice, right? Customer choice, you being able to decide what to do with your data. So I'm hoping to see that people have more control or agency over their data and how they share it and not feel like oh, I'm forced to share, you know, or, you know, the US a lot of times companies because we don't have the same types of laws, you know, many of these companies, they some of them go too far, obviously, with how they handle or manage data, but being able to give someone some type of control to say, you know, look, you know, we, we want you as a customer, you know, we want to, you know, just being transparent with people, what you're using the data for, I think will be really helpful for them to be able to make an informed decision about how they share their data with you or if they even want to share their data with you. Yeah, so yeah, well, excellent, excellent. Well, we're ending, we're coming at the end of our show. And thank you so much for doing this. This is such a hot topic. So I know a lot of people are going to be really excited to hear, you know, our conversation. But I think, you know, you're at the forefront of this. And you've been sort of thinking about this. And I think, especially with the iOS 14 update, with people getting more transparency about their data, and then recently, you know, with WhatsApp, they are privacy trains, people just went crazy about that. So yeah, so that gives me hope that people really do care about their privacy, and they won't, they want more transparency, and they want to be able to make, you know, informed decisions about how they share their data.
Sanna Toropainen 40:55
Yeah, sure. They do. Yeah, thanks so much. It is always such a pleasure to talk with you. I really enjoy it.
Debbie Reynolds 41:02
Yeah, yeah. We're gonna be talking more because I think data monetization issues gonna really eat up 20.1 Very much so. So I think we were talking more about this year. Excellent. Thank you so much. I really appreciate it.
