How do you ensure that all the data Majid Al Futtaim collects is secured?

Guillaume Thfoin. All the data is stored on the cloud and is encrypted at rest and in transit; even if there is a leakage, it’s illegible. We have a compliance and security department that takes this very seriously.

Joe Abi Akl. When we started this, the first challenge we faced was trust – even within our business, before we get to the customer. Our businesses didn’t want to share data with each other because they work with different competitors. We had to explain to them that, the same way the holding company owns the financial capital, data is our new capital and we should own it for the benefit of the group. We agreed with them on a set of principles around how this data is used, shared and consumed. We have a very strict set of rules around who can access the data, who can use it, in what capacity, and how it is shared. Then, we made sure that whatever data we’re collecting abides by a set of data governance and customer-related privacy rules. We have a very detailed data governance strategy. My team is responsible for executing it and for creating checks and balances, and we have a different compliance team that is responsible for making sure that my team is actually doing this the proper way. And we’ve created separations between the two.

Majid Al Futtaim is very proactive about protecting the data and being a good citizen when it comes to analytics. Dubai has launched the AI Ethics Advisory Board six months ago, and Majid Al Futtaim is sitting on that board alongside IBM, Google and Microsoft. Majid Al Futtaim is the only local, non-tech company sitting on this board.

Are you following the European Union’s General Data Protection Regulation (GDPR)?

Guillaume Thfoin. The first thing we did three years ago was to ensure that we collect consent from all our customers to use that data and to share it internally – which is one of the 60-goal basis for GDPR. We set up one privacy policy across all the groups, which is the most important cornerstone for GDPR. We are not, today, fully GDPR-compliant, but the plan is to follow this through. By default, GDPR is going to be the regime for the most advanced protection, so we should prepare for it and align towards it. To secure that data, we’re following the ISO/IEC 27001, which is for best security practices in terms of data management. The whole group is going to be ISO 27 001 compliant.

How do you use data and analytics beyond business purposes?

Joe Abi Akl. We believe that we have a responsibility towards the society we’re in – and this is not just something we’re doing from a marketing perspective. We do a lot of partnerships with the likes of Smart Dubai to run use cases that are for the benefit of society.

Guillaume Thfoin. Because we want to have a stellar international reputation and tech credibility, we need to position ourselves on the global scene. We do that by partnering with very big partners and working on things for the greater good.

The Wharton School is leading the Wharton Customer Analytics Initiative; they’re the connection between students who need data for their research and companies that have such data. Working with them, we released 60+ terabytes of anonymized data about our businesses to the academic community and told them: Here are 12 problems, come back to us with a research proposal. We were very surprised because, typically, companies get about eight research proposals; we received 43 excellent research proposals from top universities like Stanford, Cornell and Berkeley, out of which we selected 11. That’s a way to connect with the community and share that for the advancement of research.

We’re also working with the UN Global Pulse – the United Nation body for using big data and AI for the greater good – as part of the United Nations Sustainable Development Goals. We started with a local implementation with Smart Dubai. We know that Dubai has a lot of issues with diabetes, cholesterol, cardiovascular diseases and obesity. Our use case is on how we can use data to predict and support that. With Carrefour, we have access to all the data about what people consume; from that, we can derive a health index. Then, because people tend to live close to their supermarket, we can derive a health index at the community level – never at a personal level. We overlay that with healthcare data to know where the clinics are and how well they treat for those issues in each area. And then, we bring in the school’s data in partnership with Smart Dubai, to know the number of schools and the kind of curriculum (which tells us the kind of nationality) in each area. From all that, we can drive an education and awareness program targeted to parents.