1 of 17

Developing and Implementing a Data Management and Governance Plan for Airbnb

Christopher Lindsey

SJSU iSchool

INFM 206: Electronic Records Fundamentals

Dr. Cervone

March 7, 2021

2 of 17

What is data management and governance?

The process through which data and records are:

Acquired
Stored
Protected
Utilized

3 of 17

Benefits of data management and governance�* Regulatory compliance�* Improving processes�* Maximizing data value

As Laura Sebastian-Coleman notes in her essential text on the subject, data governance is often confused with database administration—which involves highly technical processes. Data governance goes beyond simply managing databases. “Data governance describes the processes by which organizations make decisions about data that need to be carried out by people throughout the enterprise” (Sebastian-Coleman, p. 53). In general, benefits of data governance include:

* Reducing risks of regulatory non-compliance (we must conform to all federal and local data privacy and governance laws and regulations wherever we do business)

State and Federal laws exist to prevent inappropriate use of data. For example, GDPR exists to protect people’s personal information in Europe, and in California, the CCPA exists to enhance privacy

rights and consumer protections

* Improving and streamlining the processes that run this business; centralizing critical data, making it easier for employees to find documents and data.

* Maximizing the value and usefulness of the data we already have and are already collecting

4 of 17

Why is data management and governance important to Airbnb?

Data quality

Data quality = better search
Reliable, trustworthy listings = increased user trust

Data security

Sensitive data on our servers such as photos of user ID cards, credit card and bank account numbers

Compare costs across regions
Apply advertising resources effectively
Understand the needs of our hosts and guests
Maximize our decision-making capabilities��

5 of 17

Regulatory compliance� �California Consumer Privacy Act (CCPA)��

The right to know how collected data is being used

The right to delete personal information collected

Since we are headquartered in California, I will briefly touch on one of the sets of consumer privacy laws and regulations to which we are beholden: The California Consumer Privacy Act

A very important right our users have—related to privacy and afforded by the California Consumer Privacy Act—is “the right to know about the personal information a business collects about them and how it us used and shared” (oag.ca.gov, 2021).

Another very important right our users have is “the right to delete personal information collected from them” (oag.ca.gov, 2021). Since we collect payment and location information as well as personally identifying information such as ID card numbers and photos, we owe it to our customers to be able to assure them that we have deleted their personal information if and when they would like to conclude their business relationship with us.

We’ll cover ideas about how to comply with CCPA in later slides…

6 of 17

7 of 17

Plan

Business assessment
Technology assessment
Appoint responsible data officers

Business assessment: Sometimes called a Data management maturity assessment, this initial assessment will assess the current state of our business and processes and will pose such questions as: How does the company currently use people, processes, and technology to manage and get value from data? Who is in charge of these processes? How is our data quality monitored? What privacy policies do we consider and enforce? How is our confidential data protected? Disaster recovery?

And finally… What is our capacity for change? How well do we collaborate?

Technology assessment: Strategically tie the business requirements determined in step 1 (Business assessment) to a logical and physical information architecture. If necessary, upgrade technical infrastructure.

Appoint officers to be responsible for various aspects of data governance including regulatory compliance in each region, physical and cybersecurity, metadata management, data quality assurance, etc.

8 of 17

Design & Enable

Taxonomy design
Metadata development
Develop training and operational manuals (step-by-step with screenshots)

9 of 17

Schema.org:�LodgingReservation

10 of 17

Create/obtain

Property listings

User profiles with payment information

11 of 17

Store/Maintain

Data Security must be managed throughout the data lifecycle

Educate out hosts on various types of scams

Configure our messaging systems

to scan for attacks

To quote from Laura Sebastian-Coleman’s Navigating the Labyrinth: “Data security must be managed throughout the data lifecycle: Data management includes ensuring that data is secure and that risks associated with data are mitigated. Data that requires protection must be protected throughout its lifecycle, from creation to disposal” (Sebastian-Coleman, 2018, p. 26).

Considering that we have user ID numbers, user ID photos, user credit card numbers, user bank account numbers, home addresses, email addresses, and more, we have a moral, ethical, and business obligation to do whatever it takes to keep that data secure.

According to Verizon’s 2020 Data Breach Investigations Report, one of the most common attacks in the rental industry involve “social engineering attacks in which adversaries insert themselves into the property transfer process and attempt to direct fund transfers to attacker-owned bank accounts” (DBIR, 2020). This kind of scam is surprisingly easy to set up. Basically, you contact someone with an Airbnb listing, tell them that you’d really like to book their space but Airbnb’s booking system is currently down but you’d be happy to simply transfer them the money if they’d simply provide you with their routing and bank account numbers. While most people would not fall for such a scam, if you pitched this situation to enough hosts, eventually you’ll find one who will fall for it. It’s even happened to me when I was hosting (I didn’t fall for it). Our response to this kind of security attack will be two-pronged:

* We educate our hosts on the possibility of this kind of scam. We tell them convincingly to ONLY perform booking transactions through our booking systems and to NEVER accept payment through any other means.

* On our end, we configure our messaging system to automatically scan for this kind of attack and we flag and review repeat offenders. Also, we prevent any sequences of numbers to be communicated through our messaging system.

12 of 17

Use & Enhance

13 of 17

14 of 17

Dispose of

Train our customer service representatives on the proper way to delete an account
Notify the user in writing that their account has been deleted
Keep a log to show that data associated with their customer ID number no longer has data associated with it
Prevent our servers from ever being able to recover or restore the deleted data

As mentioned, a very important right our users have—a right enshrined in the CCPA—is “the right to delete personal information collected from them” (oag.ca.gov, 2021).

Since we collect payment and location information as well as personally identifying information such as ID card numbers and photos, we owe it to our customers to be able to assure them that we have deleted their personal information if and when they would like to conclude their business relationship with us. Assuming that we do not have to keep their data for tax or other legal purposes, we must perform the following steps:

* Train our customer service representatives on the proper way to delete an account

* Notify the user in writing that their account has been deleted

* Keep a log to show that data associated with their customer ID number no longer has data associated with it

* Prevent our servers from ever being able to recover or restore the deleted data

15 of 17

A plan for maintenance

Content Management

Rental property listings and photos
Always consistent with Schema.org

Security

Control of network ports and protocols
Ongoing employee training, testing, and retraining

Content Management: Content management is an important aspect of the business. “Content management refers to the processes, techniques, and technologies for organizing, categorizing, and structuring information resources so that they can be stored, published, and reused in multiple ways” (Sebastian-Coleman, 2018, p. 107). Content that must be managed in Airbnb’s content management system include rental property listings and photos. The photos must have metadata attached including location, keywords, and permissions. All metadata attached to photos and dynamically-generated web pages must have metadata schema from Schema.org.

According to Verizon’s 2020 DBIR, the Accommodation and Food Service industry is often targeted to access the wealth of payment card data in businesses such as ours (DBIR, 2020). Since we do our payments in house—and not through PayPal or similar—we have to be extra careful about our security. Since our hosts never see or have access to any payment data, the onus is on us and our own security at our HQ and satellite offices. The top controls necessary to prevent data breaches in our offices are pretty standard: “Limitation and control of network ports, protocols, and services; and Boundary defense” (DBIR, 2020). Additionally, we must train our employees to avoid phishing attempts through corporate email and malware on employee computers. While hacking used to be the realm of hackers with advanced unix and network protocol skills, nowadays a shocking number of data breaches are the result of stolen employee credentials. This we must prevent through careful training, testing, and retraining of all of our employees and contractors in ways to recognize and avoid phishing scams, social engineering scams, and all other types of common attack portals.

16 of 17

Potential for Big Data Analytics

Predictive analytics

Further exploration…

Airbnb creates enough booking data to start thinking in terms of big data analytics. According to Statista, Airbnb had 187 million bookings in 2019 (Curry, 2020). That’s over 512,000 bookings a day, 350 bookings a minute. This constitutes a big data stream. Using predictive analytics, we have the potential to predict our continued business growth and revenue, and to predict where we need to put more or less advertising resources going forward. Also, we have large, unstructured data sets being continuously created on our platform which may be useful in terms of big data analytics. For example, we have messages between hosts and guests, before, during, and after their stay. Also, we have the movements of our guests before, during, and after their stay. Based on the vastness, variety, and velocity of that data, it’s probably worth to effort to collect all these streaming and at-rest, structured and unstructured data into a big, bubbling data lake for further exploration.

17 of 17

Additional resources

California Consumer Privacy Act (CCPA). State of California - Department of Justice - Office of the Attorney General. (2021, February 2). https://oag.ca.gov/privacy/ccpa.

Deane, S. (2021, January 27). 2021 Airbnb Statistics: Usage, Demographics, and Revenue Growth. Stratos Jet Charters, Inc. https://www.stratosjets.com/blog/airbnb-statistics/.

2020 Data Breach Investigations Report. Verizon Enterprise. (2020). https://enterprise.verizon.com/resources/reports/dbir/.

Henshall, A. (2019, September 11). What is Records Management? How to Build a Records Management Process: Process Street: Checklist, Workflow and SOP Software. Process Street. https://www.process.st/records-management/.

Sebastian-Coleman, L. (2018). Navigating the labyrinth: an executive guide to data management. Technics Publications.