What is outsourcing?
Businesses outsource many functions as the most cost-effective and strategic means to maintain focus. A classic example is payroll outsourcing, where relevant employee work data is exported to the payroll vendor, who produces paychecks, direct deposits, records of deduction, and the rest of those things that an internal payroll department would normally do. Other examples can include outsourced customer support, marketing, scheduling, installation, retirement planning, employee assistance programs, and so much more.
More recently, businesses have been compelled to outsource machine learning (ML) as a core component of data analytics, toward continuously improving competitive strategies and position. Similar to classic outsourced functions, data is communicated between the client and the vendor, who returns a bespoke ML model.
Risks of Outsourcing
Each outsourcing example carries risk, as the acquisition and communication of data between different entities invites error–explicitly or tacitly–in a number of categories. Included are privacy and security breaches, communication and process barriers, technology mis-match, dubious remote access protocol, service level lapses, and even geographic location of teams. Further, outsourcing a function requires that a certain amount of process control be yielded to the vendor.
Privacy and Security
Privacy and security breaches are of particular concern, from both ethical and legal perspectives. The EU’s General Data Protection Regulation (GDPR) is a core component of human rights and privacy law; similarly for the California Consumer Privacy Act (CCPA). Guidelines are available around consent management platforms (CMPs) to help organizations comply with such regulations. Under these guidelines user choice and privacy requirements are met through anonymization of personal data that is collected, processed, retained, or destroyed. This is accomplished through a variety of techniques, including generalizing and suppressing, anatomizing and permuting (i.e., de-link relationships between data attributes without modifying them), and more. The goal, then, is to remove the risk associated with legal consequences of non-compliance.
Loss of Control
Further to loss of control, outsourcing anonymization carries risk. For example, beyond a certain threshold of anonymity there is a loss of critical context (especially for ML models), as the proverbial baby is discarded along with the bathwater. At the other extreme, some models are easier and faster to construct when questionable–even illegal–data is included. In such cases legal consequences could be huge. It is therefore important that the outsourced function does not yield too much control to the vendor. The business remains responsible for meeting goals, hence retaining sufficient control of a data-dependent process–through people, technology, and process–is paramount.
Communication and process
Communication and process barriers speak to identifying relevant and legal data for the outsourcing activity, having common understanding (between client and vendor) of business activities that produce the data, and standards for work-product completeness and accuracy. Of critical importance to mitigating risk are sufficiently detailed service level agreements (SLAs), critical success factors (CSFs), key performance indicators (KPIs), and meaningful evaluation protocol between the client and vendor.
Technology mis-match and dubious remote access protocol
Once again, legal consequences can be severe when technology platforms between client and vendor are mismatched and/or if there are leaks in remote access protocol that invite data compromise. If accessing and transferring data is not rock-solid and trusted, both the quality of the outsourced work product and the legal ramifications around data breaches can derail a business initiative, or even an entire business.
Conclusion
Businesses outsource many functions, but the more recent imperatives around ML and data science introduce greater risks than any time before. In simplest terms, the business can delegate authority to the vendor around the tasks necessary to create the work product; e.g., a bespoke ML model. But the business retains responsibility to meet business goals associated with the model. That means minimizing risk associated with outsourcing by ensuring legal compliance around privacy and security, ensuring that measures of quality and success are in place, that technology and technical communications follow rigorous standards of trust, and most of all, that the vendor to which the business outsources critical functions is competent to deliver quality work products.
If your business needs guidance around outsourcing data-intense functions and understanding what the data is telling you, reach out to Gemini Data. We help businesses solve their biggest data challenges and go from data to insights faster .
