Kurt Roloff says large pharma often treats compliance as a cost center, but secure collaboration can turn existing data into a profit enabler. It lets divisions and companies reuse data across geographies, cutting IRB and administrative overhead so rare pediatric cancer research becomes more cost efficient.

To overcome data silos in a regulated environment, CIBC prioritized building internal trust. They proactively brought legal, compliance, and privacy teams together, clearly defining the use case and value of unified data, which was critical for gaining enterprise-wide approval.

Companies often focus on avoiding fines by being overly cautious with data, a practice called "under-permissioning." This creates a huge opportunity cost by shrinking the marketable audience and leading to wasted ad spend on generalized campaigns.

A CIO can survive a standard data breach, but a CIO who gives away proprietary company data to an AI model will be fired. This distinction explains the high level of caution from IT leaders, which is rooted in existential career risk, not just resistance to new technology.

Even with contractual promises from tech giants, the history of the internet suggests that "privacy is a game." For corporations with sensitive information, the only certain method to prevent data from being shared or used for training other models is to not share it in the first place, driving demand for on-prem solutions.

Jurgi Camblong argues the concept of "data ownership" is a misnomer, citing GDPR's framework of data subjects, controllers (hospitals), and processors. By positioning as a trusted processor rather than an owner, Sophia Genetics gains access to a wider, decentralized network, which is more powerful than a centralized, owned dataset.

Roloff says every country sets its own data rules, but Germany's GDPR decisions, plus forward-leaning Singapore, South Korea and California, influence others. Showing a European customer that German courts accept this technology makes regulatory and customer conversations easier, he says, because other jurisdictions often follow the perceived leaders.

Digital trust with partners requires embedding privacy considerations into their entire lifecycle, from onboarding to system access. This proactive approach builds confidence and prevents data breaches within the extended enterprise, rather than treating privacy as a reactive compliance task.

Roloff says getting the privacy technology in place is usually the easy part. The harder work is communicating with regulators, standards bodies and policy authorities about changing workflows and liability. He personally meets with Capitol Hill, White House and NIST/OSTP officials to move that conversation forward.