From BYOD … to BYODa. From “Bring Your Own Device” to ……
By: Vassilis Papakonstantinou
Tags: Security, Privacy, Insurance, AI, Data

Around 2009, employees at Intel started bringing their own smartphones, tablets and laptop computers to work and connecting them to the corporate network. That was the beginning of a new trend that became known as “BYOD”, short for “Bring Your Own Device”. The most challenging aspect of BYOD policies was data security. However, perceived productivity gains and cost savings were compelling enough to find ways to address data security issues.

A few years later, Oscar Health started asking its customers to report their daily step count in exchange for various perks, like Amazon gift cards. Oscar was among the first companies that were telling their customers “Bring Your Own Data” or “BYODa” for short, leveraging the explosion of the “quantify me” movement and the growth of wearable devices. Over the following years several other insurance and wellness companies started introducing BYODa based programs that encouraged or required customers to report some of the data they generated while going about their daily lives; from the steps they took, to their vitals, to the food and beverages they consumed, to their activity, to their driving patterns and more.

Photo by Artur Łuczka on Unsplash

Most BYODa based insurance programs are marketed as encouraging behavior change towards more responsible lifestyles that are connected with lower health risks. Obviously, that’s a good thing for both the insurance companies and their customers. But BYODa based insurance programs have more far-reaching implications; they pave the way to behavior-based insurance policies. Early applications of behavior based insurance can be found in the auto space where usage-based insurance (UBI) programs, also known as pay-as-you-drive (PAYD) or pay-how-you-drive (PHYD), are becoming a trend.

Outside of insurance, BYODa practices are emerging in other areas of digital activity, from banking to health and marketing, and involve companies interacting directly with their consumers through mobile apps. To a certain extent, this was to be expected for two reasons. First, consumers are becoming more data privacy and security aware, as a result of major data incidents and the associated regulation that has been introduced. Second, consumers are becoming increasingly more capable of and interested in collecting their own data using their smartphones and wearables. So companies that have data-driven, consumer-facing business models understand that they are better off asking their customers themselves to bring their user-generated big data, instead of relying on other sources that skim generic consumer data from the web or mobile apps, as they used or continue doing.

At the same time, consumers are starting to understand the value of their own big data, so for BYODa practices to be successful, the companies have to provide some value back to the consumers generating it. We are in the early days of BYODa economy and the value exchanged between companies and consumers is low. The companies are exploring what they can do with the data they get and what value it can add to their own business. Therefore they are paying back the consumers with discount coupons and gift cards, much like Oscar does. These are“peanuts”, but for now, everybody seems to be happy. Not for long though. The relationship is bound to change, as the value at stake will increase dramatically over the next few years.

As we are moving towards that direction there’s a question that needs to be answered. How can Oscar, or other BYODa practicing insurance companies, be certain that the step count I uploaded last night is actually my step count? What stops users from uploading a step count that belongs to their kids, their pets, to themselves from a previous day or that is digitally synthesized? This question can be generalized as follows: “how certain any BYODa practicing company can be that the user-generated data reported was produced by the reporting individual and in the reporting context”. In this general form, the question represents a kind of “user-generated data attribution” problem for the BYODa practicing companies in general.

If you would ask this question to the practitioners, the typical answer you will get today is “we are looking at it, but this is not a problem”. The important thing though is not that it is not a problem, but that it is not perceived as a problem today. They are right … today. But BYODa practices are not built for today. They are meant to deliver a continuous timeline of behavior related user-generated data that will serve as a basis for the decision making process of companies in the future.

So let me elaborate why the “user-generated data attribution” is not a problem today but it will certainly be a very big problem in a couple of years if left unaddressed. Today the value paid back is “peanuts” and the consumers that are subscribing to BYODa based programs are early adopters; therefore they don’t have any significant incentive to “fake” their own data, or at least in large numbers to cause problems to the companies. However, in a couple of years, things could be very different. BYODa streams will be used to feed more complicated corporate decisions, say behavior-based insurance, and the value at stake will be much higher, say significant discounts on insurance premiums. Then the incentives of the data-reporting consumers will be very different and they will have significant reasons to “fake” the reporting data. Then, the BYODa practicing companies will find themselves in trouble, not necessary because the “fake data” would be a really high percentage, but primarily because they will have no idea how big the “fake data” problem is.

If the “user-generated data attribution” is not addressed successfully there will be implications also for the consumers that participate in BYODa programs. Let’s take the insurance industry as an example. A user reports daily the activity data she is producing according to the requirements of the program and gains the benefits, for instance, free medication or discounted insurance fees. Suddenly she gets a notification that she’s in breach of contract because her latest data stream shows, for instance, risky behavior. How can she defend herself? How can she prove that there was a mistake, coincidental or purposeful, in the reported datastream? How can she prove, beyond doubt, that the reported datastream was corrupted and that her actual activity data is in line with requirements?

Photo by Franki Chamaki on Unsplash

BYODa practices have much higher perceived productivity gains and cost savings for both companies and consumers across a number of AI-powered and data-driven industry verticals. But if they are to become widespread and successful the “user-generated data attribution” problem has to be addressed much like the data security issues were addressed in the BYOD case.