My contribution to a board
The boards I would want to join usually hear about customer data in two forms: a security report from the chief information security officer, and an occasional presentation on what analytics or advertising could earn. They seldom see what lies between, which is where a company decides which uses of customer data it will allow, what each is worth and what it costs in trust and regulatory exposure. That middle ground is my work. I can read a consent design, the objective of a pricing model or a data-sharing agreement and tell a board which decision is buried inside it, often a decision nobody has noticed making.
I also bring an unusual range of positions in the trade in shopper data. I have measured shoppers as a panel statistician, bought retailer data as a supplier, sold insight as a coalition loyalty operator and held the data as a retailer. When management describes a data partnership, I know what the counterparty will want, what it will do with what it receives and which contract clause it will try to soften.
I would be a careful audit committee member but not its financial expert. I read statements and controls reports comfortably, and I am a statistician rather than an accountant. I would expect to be most useful on a risk committee, or on a technology and data committee where one exists, and I would want a full year as a member before chairing either.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | Technology, data or privacy committee of a board · Risk committee of a consumer-facing company, after a full year as a member |
|---|
| Ready to join | Risk committee · Audit committee, contributing on controls and data rather than as its designated financial expert · Governance and nominating committee |
|---|
Capacity and preferences
- Time available
- 22 days per year
- Current directorships
- 1
- Sectors
- Telecommunications and subscription businesses with large customer databases · Member-owned financial co-operatives and credit unions · Travel and hospitality companies with loyalty programmes not partnered with Mirebrook · Health charities and research foundations that hold donor or patient data
- Company type
- A TSX-listed mid-cap company or a large co-operative with a consumer membership and a functioning risk committee
- Company stage
- A business whose customer data has become a revenue line or a regulatory question faster than its board's oversight has adapted
The seat I am pursuing
I am looking for one non-executive seat on the board of a TSX-listed mid-cap company or a large co-operative whose customer data has become a source of revenue, a regulatory concern or both, faster than the board's oversight has developed. Telecommunications and subscription businesses, member-owned financial co-operatives, travel and hospitality companies with loyalty programmes, and health charities holding donor or patient data are the settings where my experience would transfer most directly. I would like to join the risk committee, or a technology and data committee if there is one, and chair it after a full year if the board wished. I am not interested in a seat offered because data is fashionable, and I would want to understand before a second conversation what the chair believes the board cannot currently see and how the company would react if a director recommended giving up revenue to protect customers.
Judgement in practice
01Sending the board the memo that argued against me
When I recommended against a facial recognition pilot in 2024, our vice-president of asset protection disagreed strongly, and several store colleagues who had been threatened agreed with him. I could have summarised his case in a paragraph. Instead I asked that his memo go to the board in full beside mine, with the figures that cut against my view: the rise in incidents, the stores where losses were worst and the estimate of what the pilot might have recovered. The board chose my approach with a twelve-month review, and it did so knowing what it was declining. When the review came, the committee asked about colleague safety as well as shrink, which led us to fund guards and entrance changes in the worst-affected stores. As a director I would expect management to bring dissent to the board intact, and I would ask for it when it was missing.
02Asking a committee to take authority away from management
In 2024 I proposed that our list of 38 health-inference categories, which limits what marketing and the partner network may do with member data, should be approved annually by the audit and risk committee rather than by management. One director asked why an executive would want a committee to tie management's hands. I answered that the pressure to shorten the list would come from business lines I work with every day, in small and reasonable steps, and that a committee seeing each proposed removal was a better guard than my own resolve. The committee accepted, and has since declined one proposed removal and approved another with conditions. On a board I would look for the decisions that management is quietly making on the board's behalf and ask whether the board should be making them.
03Declining a donor's request for recipients' data
In 2023 a corporate donor offered Larkhollow Food Rescue C$250,000 on condition that it receive de-identified data on the household composition of people using our partner agencies, to inform its own product marketing. The executive director was inclined to accept, because the grant would have funded a refrigerated truck. As chair of the technology and data committee I recommended declining. The people concerned had not agreed, the data could be re-identified in small communities and the agencies had trusted us with it for a different purpose. The board declined, and the truck was funded the following year from two smaller grants with no data conditions. I learnt that a non-executive's job is sometimes to say no to money the organisation needs, and then to help find the alternative.
My first year on a board
I would treat my first year as an apprenticeship in how the company earns money from its customers and what it owes them in return.
Before my first meeting I would ask for three documents: an inventory of the company's uses of customer data with the consent or legal basis each relies on, the last two years of risk committee minutes and a sample of recent customer complaints about privacy or pricing. I would meet the chair of the committee I joined, the chief privacy officer, the head of internal audit and the executive who earns the most from customer data, separately, and ask each of them what the board has not yet been asked to decide.
During the year I would visit operations rather than headquarters: a contact centre, a store, a distribution site, wherever customer data is collected or used in practice. In meetings I would ask few questions and make each one specific. I would avoid proposing changes until I had seen a full annual cycle of risk reporting, unless I found a consent or disclosure problem that could not wait.
At the end of the year I would ask the chair for a frank view of whether my contributions had been useful and whether my retail perspective had helped or narrowed my view of a different business, and I would act on the answer.
Conflicts and their management
The sectors I would decline are those in which Mirebrook competes or does business. I would not join the board of a pharmacy, a beauty or cosmetics retailer, a grocer with dispensaries, a loyalty coalition, a consumer health or cosmetics manufacturer that advertises through our partner network, or a vendor of advertising or clean room technology that Mirebrook uses or is evaluating. That list rules out most of the industry I know best, which is the point.
Before accepting any seat I would set out in writing my employment, my Mirebrook shareholding, my role at Larkhollow Food Rescue and Mirebrook's product donations to it, and any contract between Mirebrook and the company or its main suppliers. Our chief executive and general counsel would review that disclosure before I accepted.
After appointment, if a matter touched Mirebrook, its suppliers or its competitors, I would tell the chair in advance, leave the room and ask for the minutes to record it. Mirebrook's member data, pricing methods and supplier terms would stay out of every discussion, even where they seemed directly relevant. If recusals became frequent, I would resign rather than occupy a seat in which I could not take part. The twenty-two days I can give each year would be agreed with my employer beforehand and would include preparation time and a reserve for unplanned meetings.
My independence statement
I am a full-time executive of Mirebrook and hold Mirebrook shares through its employee plans. Any board considering me would need to know both, together with my directorship of Larkhollow Food Rescue, which receives product donations from Mirebrook, and any commercial relationship between Mirebrook and that company. Whether I am independent is a judgement for that board to make under the Canadian securities rules that apply to it, and I would ask it to make the judgement on full disclosure rather than on my own description.
Board and committee exposure
Served as a director
Larkhollow Food Rescue
Board of directors; chair of the technology and data committee from 2022
June 2021–present
Director of a Toronto charity that collects surplus food from retailers and growers and redistributes it to about 160 community agencies; chairs the committee overseeing its donor and recipient data.
Member of a committee
Larkhollow Food Rescue
Finance and audit committee
2022–present
Reviews the annual budget, the auditor's management letter and the charity's grant restrictions with the treasurer and two other directors.
Presented to the Board or a committee
Mirebrook Pharmacy & Beauty Inc.
Audit and risk committee
2022–present
Presents a quarterly report on data and privacy risk with the chief privacy officer, and the annual review of the 38-category health-inference list.
Presented to the Board or a committee
Mirebrook Pharmacy & Beauty Inc.
Full board
2023–2024
Presented the member consent programme, the partner network's clean room rules and the recommendation against a facial recognition pilot.
Reported to a committee
Vellacott Rewards Inc.
Board member data and privacy committee
2017–2020
Prepared the committee's reports on partner data sharing, the preference centre and partner audit findings.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian register for people seeking to serve as independent directors of Indian companies. It does not apply to me: I live and work in Canada and am not pursuing an Indian directorship, so I have not registered. A Canadian listed company would assess my independence under Canadian securities rules instead.
- Director education programme, Carroway Directors' Institute, completed 2024
- Course on financial statements and internal control for non-financial directors, 2023
- Quarterly briefings to Mirebrook's audit and risk committee on privacy, cyber security and data controls since 2022
- Charity board service since 2021, including finance and audit committee membership