Thomas Whitmore · Chief Data Officer · Canada
Most boards now oversee data they did not create. Customers, members and partners supply it for one purpose, and management soon finds valuable second uses: analytics, pricing, model training, sale in aggregate. I would help a board ask, before approving such a use, what the supplier of the data actually agreed to, how the company knows the data is accurate and what could be disclosed if records were combined. Location deserves particular attention, because coordinates attached to an otherwise harmless record can identify a property, an asset or a person. I would not claim expertise I lack. I have not been a corporate director, and an insurer's or a co-operative's regulatory obligations differ from mine. My contribution would be practical: reading the consent wording, asking for the lineage of a dataset that supports a decision, and distinguishing a technical capability from a permission. I would expect management to own the answers and the board to test whether those answers would satisfy the people whose data is in question.
| Capacity | Committees |
|---|---|
| Ready to join | Audit and risk · Technology, privacy and cyber oversight |
I am seeking a first independent seat on the board of a Canadian organisation that relies on data supplied by customers, members or partners and is beginning to use it in new ways. A regional insurer, a credit union, an agricultural co-operative or an engineering and environmental services firm would each suit, provided none is a Pellarwick customer, competitor or supplier. I would join an audit and risk committee or a technology and privacy committee and would not expect to chair either until I had served at least a full term. A listed company's board would bring disclosure and audit committee expectations that I would learn with the chair and counsel rather than assume from my present role.
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian requirement and has no bearing on a Canadian appointment. I have not registered. If an Indian independent directorship were ever proposed, I would take advice and complete the applicable process first.
Presented to the Board or a committee
Board of directors; data, privacy and machine-learning matters
April 2021–present
Presented the model-training consent framework, the acquisition data-lineage standard and the benchmark redesign; not a director.
Reported to a committee
Audit and risk committee
January 2022–present
Quarterly report on data incidents, access reviews, customer data requests and open consent questions.
Served as a director
Board of directors; finance and grants committee member
June 2018–May 2024
Unpaid director of a charitable foundation awarding about C$140,000 a year in bursaries; reviewed annual financial statements and grant decisions.
When our product team relied on a 2016 service-improvement clause to train a shared detection model, the legal argument was arguable and the commercial pressure was real. The question I put to our board was how a municipal procurement officer would read the clause if a council asked. A board should ask that kind of question whenever management proposes a new use of data supplied by others. A separate consent cost us seven months and a third of the potential training set, and it limited the model's accuracy in rural areas. It also meant that no customer could later say we had used its imagery without agreement. I would encourage another board to weigh the delay against that durability, and to ask management for the customers' own wording rather than a summary of it.
During the benchmark redesign we found that a demonstration file with street names had been shared with a prospective insurer under a non-disclosure agreement. The file was deleted and no harm was reported, so management could have treated it as closed. I reported it to the audit and risk committee because it showed that a data question had reached the commercial team before it reached governance. The committee asked for a change to the product approval process, not for blame. I would expect the same from a board I joined: that near misses are reported with what they reveal about process, and that directors respond by examining the control rather than the individual who exposed the gap.
When an acquired records product disagreed with our platform by up to two metres, the easiest option was to adjust positions to a best estimate and release on schedule. Labelling 412,000 records as unverified looked worse in a sales demonstration and drew complaints. For assets that crews excavate around, though, a confident wrong position is more dangerous than an honest uncertain one. On a board, I would ask management to show where its data is uncertain rather than average the uncertainty away, especially in a post-acquisition integration where the pressure to report integration savings is strong. Directors cannot verify the data themselves; they can insist that its limitations appear in the papers.
My first quarter would be spent reading. I would ask the company secretary for two years of board and committee minutes, the risk register and any data or privacy incident reports, and I would read the contracts or membership terms under which the organisation receives its most important data. I would ask to meet the chief executive, the chief financial officer, the person responsible for privacy and the head of internal audit separately. By the second quarter I would expect to understand where management believes data creates value and where it believes the risks lie, and to have noticed any gap between those two accounts. Over the remainder of the year I would contribute to one substantive review, such as the oversight of an analytics or machine-learning initiative, and ask the chair for candid feedback at twelve months on whether my questions had helped the board or merely added length to its meetings.
Pellarwick sells to municipalities, electricity, gas and water utilities, and survey and engineering firms across Canada and the northern United States, and it buys hosting, imagery and software from a range of suppliers. I would therefore decline seats at current or likely customers, competitors and material suppliers, and I have said so to my chief executive and to Halvercroft. Engineering and environmental firms need particular care, because many hold Pellarwick licences; I would ask the prospective company for its software supplier list before any conversation went further. Where an indirect relationship emerged after appointment, I would disclose it to the chair in writing, step out of discussion and voting on the matter, and resign if the relationship became significant. I would not use information from either organisation in the other. My Pellarwick employee shares and options would be disclosed in full.
I hold no shares in any company other than Pellarwick, where I own employee shares and options. Before any appointment I would list every commercial relationship between the prospective company and Pellarwick, including indirect ones through survey or engineering firms, and leave the independence judgement to that board and its advisers.