Blog

I asked the Chief Security Officer of Expedia Group a question with a simple surface and a sharp edge: “GDPR is a good framework, and we know that the U.S. federal government is not going to jump quickly onto that level of data privacy — so why don’t companies just adopt GDPR themselves as a standard?”

If a regulation is good, and no one is making you follow it, and following it would protect your customers — what exactly is the argument for waiting?

The honest answer tells you everything about how privacy actually works inside companies. It isn’t blocked by ignorance. It’s blocked by arithmetic: privacy restraint costs money now and pays out in a disaster that might happen to somebody else, later, in a headline with a different company’s name on it.

Look at it through the SPICE lenses — Strategy, Politics, Innovation, Culture, Execution:

Strategy. Adopting a recognized standard voluntarily is a strategic asset disguised as a compliance cost. The company that builds to GDPR-level discipline gets one global way of handling data instead of fifty state patches and a prayer — and gets to walk into every enterprise sales cycle, every regulator meeting, and every breach headline already holding the high ground. The strategy question was never “can we afford to adopt it?” It’s “can we afford to be the company that explained why it didn’t?”

Politics. Here’s why it doesn’t happen: the benefits of voluntary restraint are diffuse and the costs are concentrated. The data team that wants to collect less has no lobby. The growth team whose targeting depends on collecting more has a quarterly number. So the organization drifts to the common denominator — the minimum the strictest current law requires — and calls the drift a strategy. Nobody decided against privacy. The incentive structure decided, and everyone else just attended the meeting.

Innovation. The genuinely innovative move isn’t a new consent tool. It’s flipping the default: treat GDPR-grade rights — access, deletion, purpose limitation — as a product feature you ship to every customer everywhere, not a legal burden you geofence to Europe. Companies spend fortunes differentiating on privacy in their advertising. Almost none differentiate on it in their data architecture, which is the only place customers can actually verify it.

Culture. Privacy culture is measured by a single test: what happens to the employee who says “we shouldn’t collect this” in a room full of people who want to? If that sentence requires courage, you don’t have a privacy culture — you have a privacy department, which is a different and much weaker thing. The department writes policies. The culture decides whether anyone reads them before the launch, or only after the subpoena.

Execution. So here’s the machinery, and none of it needs a law: pick the strictest standard you already comply with anywhere — for most global companies, that’s GDPR — and declare it the floor everywhere, in writing, with a date. Inventory what you collect against it and delete what you can’t justify; data you don’t hold can’t be breached, subpoenaed, or misused. Then publish the gap list internally and burn it down quarter by quarter, reviewed on the same calendar as the revenue numbers. Voluntary standards fail when they’re aspirations. They work when they’re schedules.

Today, companies wait for regulators to force tomorrow’s standard at tomorrow’s prices, under tomorrow’s headlines. Tomorrow’s winners will have adopted it quietly, early, and at yesterday’s prices — and will market the receipt.

Ask yourself: if your customers could see your data practices the way your engineers see them, would you still be waiting for a law?

Sources

CXOTalk Ep. 776, “Cybersecurity Lessons from the Chief Security Officer of Expedia Group” — my question on why companies don’t adopt GDPR voluntarily (transcript): https://youtubetotranscript.com/transcript?v=1M3O3w8DLLg

Related post on this blog (the government side of the same question): “Does the United States (US) Need a Federal Equivalent to the European Union (EU)’s General Data Protection Regulation (GDPR)?” (Sep 19, 2023): https://arsalankhan.com/2023/09/19/does-the-united-states-us-need-a-federal-equivalent-to-the-european-union-eus-general-data-protection-regulation-gdpr/

I asked Lynn Perry Wooten, the president of Simmons University, a question that makes higher education visibly uncomfortable: “It seems like students are your customers — hence the focus on customer experience. How do you think about that?”

Watch what the question does. In a business, “the customer” is an organizing principle: the person whose experience you exist to serve, whose departure you fear, whose feedback you instrument. In a university, the same word sounds like a surrender — as if admitting students are customers means the degree becomes a product, the professor a vendor, and education a transaction with a diploma at the end.

Both reactions miss the point. The question isn’t whether students are customers. It’s what breaks when an institution refuses to decide.

Look at it through the SPICE lenses — Strategy, Politics, Innovation, Culture, Execution:

Strategy. A university that won’t name who it serves ends up serving everyone’s second priority: rankings for the board, research prestige for the faculty, amenities for the brochure. Wooten’s answer points at the strategic alternative — the student’s transformational experience as the product. That’s a harder promise than satisfaction. A customer-experience strategy for a university isn’t “give them what they want.” It’s “design, deliberately, the experience that changes who they are — and measure whether it happened.”

Politics. The customer word is a turf war in disguise. If students are customers, students get a vote — on schedules, on modality, on what a degree should contain — and every one of those votes dilutes someone else’s authority: the faculty’s over curriculum, the administration’s over tradition, the alumni’s over what the place is supposed to remain. Institutions don’t reject the customer frame because it’s inaccurate. They reject it because it’s a redistribution of power wearing a vocabulary question as a costume.

Innovation. The genuinely innovative move isn’t a chatbot for admissions. It’s importing the discipline of customer-experience design — journey mapping, friction audits, feedback loops with closing dates — into an institution that has historically run on anecdote and prestige. Where does a first-generation student actually get lost: the application, the aid letter, the first semester, the advising gap? Businesses instrument those moments because churn taught them to. Universities mostly discover them at the exit interview that never happens.

Culture. Here’s the cultural trap: in higher education, caring too visibly about the student’s experience can read as caring less about standards — as if rigor and service were opposite poles. So faculty distance themselves from the “customer” language to protect their identity as scholars, and the student’s experience becomes nobody’s identity and therefore nobody’s job. The institutions that escape this trap separate the two cleanly: the standard is non-negotiable; the experience of meeting it is a design problem, and designing it well is a form of respect, not surrender.

Execution. So here’s the machinery: pick three moments that decide whether a student stays — the aid letter, the first failed exam, the advising meeting that never gets scheduled — and assign each one a named owner, a measured outcome, and a feedback loop that closes with the student, not about the student. Publish internally, every term, where students actually fell out of the journey and what changed because of it. You don’t need to call them customers to do any of this. You just need to admit that their experience is designed — by you or by accident.

Today, universities debate the word while their students quietly judge the experience — and transfer, drop out, or never apply. Tomorrow’s winners will have stopped arguing about vocabulary and started owning the journey.

Ask yourself: if your students reviewed your institution the way they review everything else in their lives — publicly, specifically, and forever — what would the rating say about the moments you never designed?

Sources

CXOTalk, “Simmons University President: Higher Education in 2022” — my question to President Lynn Perry Wooten on students as customers and customer experience: https://www.cxotalk.com/episode/simmons-university-president-future-higher-education

I'll say the quiet part out loud: your reskilling program is theater. And everyone — the employees clicking through modules at double speed, the managers quietly denying anyone time to learn, the executives presenting the completion stats — everyone knows.

Look at what gets measured. Course enrollments. Hours logged. Badges issued. Certificates downloaded. Every dashboard is green, every quarterly review applauds the "investment in our people" — and the skills gap sits exactly where it was last year, untouched. If the goal were new capabilities, someone would have noticed by now that nobody can do anything they couldn't do before the program started.

Theater needs an audience, and the audience was never the employee. It was the board deck, the press release, the ESG report. The program was designed to be announced, not to work.

That's the Culture problem, and it's the deeper of the two. A reskilling program teaches your people something — just not what's in the curriculum. It teaches them what the company actually values: the appearance of investment over the investment itself. It teaches them that learning is a compliance exercise, something done to you on a deadline and graded by attendance. And it teaches them the quietest lesson of all: that the organization would rather fund the illusion of growth than do the uncomfortable work of changing how work gets done.

There's a second cultural poison in the framing itself. Nobody wants to be "reskilled." The word sounds like repair — you're broken, we'll fix you, then put you back on the shelf. It's something done to people at risk, not something offered to people with ambition. So the employees who most need to grow avoid it, the ones who show up are the already-motivated, and HR reports record enrollment as if it meant engagement.

And then there's the manager layer, where every reskilling program goes to die quietly. The manager is told to champion learning while being held accountable for output that leaves no room for it. Guess which accountability wins. The employee who blocks two hours for a lab gets the look. The one who finishes the course goes back to the same job, the same metrics, the same manager who never once asked what they learned. Everyone's watching, and everyone absorbs the real lesson: growth is a hobby you're permitted on your own time.

Execution is where the theater becomes visible — because real reskilling looks nothing like a catalog.

Real starts from the work, not the course library. Name the three capabilities each team will actually need next year — the ones tied to where the business is going, not where the LMS vendor's content happens to be. Build the learning around those. Put it on the clock, in the sprint plan, with the same legitimacy as a customer deliverable. Make the manager accountable for the team's growth the way they're accountable for the team's output — same review, same weight.

Then measure the thing that matters: applied capability. Can the team now do the thing it couldn't do before? Not "did they finish the module" — can they do the work. I've never seen a completion-rate dashboard close a skills gap. And close the loop visibly: the person who builds the new skill gets the new role, the new project, the new pay band. Mobility is the proof. Right now the loop runs in reverse — learn on your own time, return to the same desk — and then leadership wonders why the ambitious ones leave for the competitor who will actually use what they learned.

None of this is complicated. It's just uncomfortable, because it moves reskilling out of HR's budget line and into the operating model — into managers' calendars, into promotion decisions, into what gets rewarded on Monday morning. Theater is cheaper. Theater doesn't require a single executive to change anything about how their organization actually runs.

So here's the honest audit, and it takes about ten minutes. Pull up your reskilling dashboard. Now answer: what can your people do today that they couldn't do before the program existed? If you can't name three specific capabilities, you don't have a reskilling program.

You have a very expensive slide.

I asked Anupam Khare, the CIO of Oshkosh Corporation, a question that sounds like it’s about analytics and is actually about power: “When it comes to using data for decision making, how do you make sure that an executive or a business leader’s experience — which is to say their bias — doesn’t overshadow what the data is saying?”

Notice the trap inside the question. We assume the data is neutral and the executive is the problem. Sometimes that’s true. Sometimes the executive’s “bias” is twenty years of pattern recognition the dataset hasn’t lived long enough to learn, and the data is a beautifully formatted record of a world that no longer exists.

So the real question isn’t data versus experience. It’s this: in your building, when the two disagree, who wins — and was that ever a decision, or just a habit?

Look at it through the SPICE lenses — Strategy, Politics, Innovation, Culture, Execution:

Strategy. Data and experience answer different questions. Data tells you what happened at scale; experience tells you which parts of what happened actually mattered. A strategy that crowns either one permanently is a strategy with a blind spot by design. The manufacturers who get this right treat the disagreement itself as the signal — when the dashboard and the veteran diverge, that’s not noise. That’s the exact spot where the decision deserves a second hour.

Politics. Let’s be honest about why data usually loses. The person with the experience has the title, the budget, and the relationship with the CEO. The data has a PDF. “My gut says otherwise” is rarely an analytical position — it’s a veto held by someone who has never had to write down what their gut is based on. And here’s the part nobody says in the meeting: executives don’t reject data because they distrust it. They reject it because accepting it would mean a past decision — theirs — was wrong.

Innovation. The genuinely innovative move isn’t a better dashboard. It’s a decision protocol: a standing rule that says when a model and a senior leader conflict above a certain dollar threshold, both sides state their reasoning in writing before the call is made. Oshkosh’s framing — moving from data-driven to data-rich decision making — points the same way. The innovation is in enriching the decision, not automating the decider.

Culture. In most organizations, the career-safe move is to agree with the senior person’s experience and quietly let the data die in an appendix. So that’s what people do, and then leadership wonders why the analytics investment never changed a single outcome. Culture is what happens to the analyst who brings the inconvenient chart. Promote that person once — publicly — and you’ll get honesty for a decade. Bury the chart once, and you’ll get decoration forever.

Execution. So here’s the machinery: pick your ten most consequential recurring decisions. For each one, write down — in advance — what evidence would override the senior person’s judgment, and what experience would legitimately override the model. Review the disagreements quarterly: who won, and were they right? You now have something almost no company has: a track record for both your data and your executives’ instincts. Most leaders grade only one of those.

Today, the winner is decided by seniority and the loser is decided by silence. Tomorrow, the winners will be the companies that made the disagreement a governed event instead of a hallway war.

Ask yourself: in your last big decision, did the data lose an argument — or was it never actually allowed to make one?

Sources

CXOTalk, “Digital Transformation: Investment Strategy at Oshkosh Corp.” — my question to Anupam Khare on data vs. executive experience: https://www.cxotalk.com/episode/digital-transformation-investment-strategy-oshkosh-corp