Data privacy: Tech’s ‘dark underbelly’ bugs responsible investors

Data has been dubbed the “new oil” by many market commentators, who describe how it has become the world’s most valuable commodity, powering the technology economy in the same way petroleum fuelled 20th century industry.

But, as investors are finding, scandals caused by data leaks can be just as damaging to tech behemoths as oil spills are to supermajors.

“We have been covering data privacy for quite some time,” says Moin Syed, an environmental, social and governance analyst at Sustainalytics, which assesses responsible investment risk. “It’s one of the front and centre issues in the tech sector — and this year was the watershed moment.” 

The scandal that brought so much attention to the risk of poor data handling was the revelation earlier this year that Cambridge Analytica, a British political consultancy, had collected personal identifying information on at least 87m Facebook users.

The news provoked a public outcry and Facebook’s share price took a hit. On one day in July, following the news that the social network had lost 3m active users in Europe, the company’s share price fell 19 per cent and more than $120bn was wiped off the company’s market value.

Many of the sellers were responsible investors who divested the stock because of what they saw as Facebook’s flippant attitude to data protection. For them, data privacy has become a crucial metric when assessing the companies in which they invest.

One such investor was Nordea Asset Management, the Swedish bank-owned investment business that manages €216bn on behalf of 10m customers.

It removed Facebook shares from its sustainable portfolios following the initial reports of the Cambridge Analytica scandal. 

After Facebook’s share price fall in July, Sasja Beslik, Nordea’s head of sustainable finance, tweeted: “This is why we divested Facebook in our sustainability funds last month. ESG pays off!” 

Data security concerns struck Facebook once again, however, as last month it announced hackers had gained access to up to 50m user accounts.

Mr Beslik says he would like to reinvest in Facebook at some point, but would not feel comfortable doing so until the company is more forthcoming about how it oversees data privacy.

“We do not have enough information to do a thorough assessment in how they manage this risk,” he says. “This is one of their biggest risks, and [for us] it’s pretty much a black box about their capacity to manage it.”

Nordea developed a model for managing ESG risks more than a decade ago and Mr Beslik says data privacy has become a big part of it over the past two years.

He says the Cambridge Analytica revelations have led to a big change in attitude for the tech sector, which he feels is much needed. Mr Beslik hopes this will lead tech companies to be more open to discussing their data-handling processes with investors.

“Data is one of the biggest assets and one the biggest risks for these companies. The platform is not [what is valuable] — it’s the information they hold on people,” he says. “The entire sector needs to step up. Data privacy is a material issue and it’s here to stay.”

Several other responsible investment specialists sold their Facebook shares when the Cambridge Analytica news emerged, including US managers Domini Funds and Calvert Investments, and sustainable funds run by Liontrust of the UK. But not all ESG-focused managers with data privacy concerns divested.

Hermes Investment Management, the £35bn UK manager, decided to hold on to its Facebook stake but use the scandal as a way to engage with the company and to press it to improve its approach to data handling.

Eoin Murray, head of investment at Hermes, says the greater focus on data security has made tech companies more willing to engage with investors.

“Many of these companies are aware that they ultimately rely on users and that we, as asset managers, are investing the money on behalf of the users of their products,” he says. “We speak from informed authority.”

Mr Murray adds that he has seen some signs of progress from the tech giants in taking into account concerns raised by their users and responsible investment managers. He points to efforts made by Facebook to roll out a fact-checking service, and YouTube being more considered when recommending videos to users.

“We want these companies to self-regulate rather than wait for governments or individuals to take matters into their own hands,” he says. “Typically when governments get involved they tend to be overbearing.”

Mr Syed says the approach Hermes has taken of staying invested but using the opportunity to increase engagement is more typical of ESG managers than divesting. He says he has noticed an increase in shareholder resolutions that relate to data privacy and he expects to see them become more prevalent.

“[Data privacy] is tech companies’ dark underbelly — there is no way they can guarantee 100 per cent security,” he adds.