The demand for data privacy and information governance (IG) expertise is exploding around the world. In the Middle East and North Africa (MENA), most organizations are just beginning to encounter the regulatory and operational pressures that European and U.S. companies have faced in recent years. Six new data privacy laws have been introduced in the last 18 months, in addition to dozens of existing regulations in the UAE, Saudi Arabia and other countries.
As Middle Eastern countries ramp up their regulatory oversight and rigor over data protection, companies in the region are seeking guidance on how to evaluate their risk, implement data privacy frameworks and uphold compliance. FTI Consulting is filling this need through the expansion of its IG and data privacy practice in MENA. Senior Director Ben Crew recently joined FTI Consulting to head up the Information Governance, Privacy & Security (IGP&S) practice in the region. We recently chatted with Ben about his new role and the regulatory climate in MENA.
Tell me a bit about your background and what brought you to FTI.
I came to the UAE 12 years ago from the U.K., following a lengthy stint as a project manager for European regulatory projects at TD Direct Investing. Over the last decade in the UAE, I’ve worked on a number of merger, regulatory and privacy projects—in in-house and outside consultant roles—for two of the largest banks and the largest hotel chain in the region. At the hotel chain, I was hired to run the company’s GDPR program, which really immersed me in the ethical and legal considerations relating to data privacy. I fell in love with the fundamentals of data privacy—the change it was evoking and that it was all about giving power back to data subjects, while still allowing corporations to use data to engage with their customers. After that role, I served as a data privacy officer for several companies in the region, and through networking was connected to Sonia Cheng, FTI’s lead for the EMEA IGP&S practice.
The more I spoke with Sonia and others on the team and learned about FTI, the more interested I became in working with the company. FTI has a great reputation, and the team was giving me a chance to build the practice in MENA doing something I love. It was an easy decision to take on the role.
What is your primary focus in your new role? How does your past experience align?
We’re looking at the whole of the region for this practice, across at least 35 jurisdictions spanning from Morocco to Pakistan, Turkey to Southern Africa. I’m focused on expanding and building relationships throughout the region and growing a sizeable team of experts. A key element of our recruiting efforts will be to find people who are domain experts in the regulatory and data privacy nuances in our key jurisdictions, and also willing to bring strong opinions to the table. I’m always looking to surround myself with colleagues who can challenge me—that’s the best way to solve the tough problems our clients face.
My past experience is perfectly suited to this role. The majority of my years in the Middle East have been spent working on compliance and data privacy issues for regulated entities. These positions gave me an insider’s view of the issues, as well as experience working across borders with counterparts and authorities throughout MENA.
FTI’s IGP&S practice is expanding quickly worldwide. From your view, what are the key drivers for this growing demand?
New privacy laws are significant drivers. The pandemic, especially the increase of people working from home, is another. The UAE has worked to position itself as the perfect location for remote workers, but for organizations to allow employees to work here, there is work to be done to align mainland and free zone federal laws and manage the consequential privacy implications. We’re seeing similar trends and activities in Saudi Arabia, Bahrain and Qatar, including smart city initiatives and the expansion of permanent migration and investor visa programs. These trends will be key drivers in this region among government authorities and companies operating here.
What are the top IG and privacy challenges specific to clients in the Middle East region?
Historically, business in this region is consent-based, and it’s widely understood that when retailers ask for your personal information like an email address or phone number, you don’t give it because it will be widely shared and sold with other parties. Changing these cultural and people aspects will be difficult in establishing and maintaining a new data privacy paradigm.
No matter how airtight a country’s data privacy laws or a company’s controls, without change management to ensure everyone who interacts with sensitive data is bought in to the policies, it’s not going to work. Our teams across segments have extensive experience helping clients implement and manage widespread IG and privacy training, awareness and change management programs.
What do you think sets FTI apart from other providers?
The caliber of our people is exceptionally high. The teams who meet with clients are the very people doing the work, and are capable of providing value, quality and results without excessively large teams. FTI is also unique in the breadth of our experts’ experience and the firm’s ability to simultaneously provide global reach and local expertise.
Are there any common tech challenges you see among clients in their IG initiatives?
Many organizations don’t realize how much data they actually have or the risk it poses to their business. Once they do realize it, the legal, compliance and governance team will often get into a tug-of-war with marketing and other business units over what data needs to be retained. Finding ways to demonstrate the value and risk of data over time can be a roadblock. Alongside that, most organizations in MENA are saving everything, but have no data map or dictionary that documents the data universe and flows of information throughout the business. Without a data map, even the portion of data that does hold value becomes buried in various systems and ultimately rendered useless. Outside experts can add a lot of value in helping create a data map and aligning goals and needs across stakeholders.
Another common challenge in-house teams face is leveraging analytics tools and AI to help sort information, identify sensitive data at the source and tag it accordingly as it is generated. I think we’ll continue to see technological advancements on this front, and more businesses adopting workflows that allow them to get smarter about managing sensitive data from the beginning of its lifecycle.
Is there anything you’d like to share about your personal life?
I love adventure, but as a father to a newborn and a toddler, it’s not always easy to find the time. I recently took up desert motor cross and am enjoying learning that new sport. I’m also an avid scuba diver and dive instructor. I’ve been teaching scuba for 12 years and love the excitement of taking people to do their first dives. Skiing is another favorite activity, and I try to add one new country or ski resort to my list every year.
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, its management, its subsidiaries, its affiliates, or its other professionals.