Strong partners support AMdEX development

The audit and advisory firm KPMG – member of the Network Council – provides services for large national and international organisations and government agencies. Sander Klous is partner at KPMG, as well as a professor in Big Data Ecosystems at the University of Amsterdam (UvA). AMdEX is developing a ‘digital notary‘ that enables secure and controlled data sharing.

What solution(s) can the smart use of data offer in your line of work?

Sander Klous (KPMG)
Photo: Don Wijns

“Currently, there are no proper mechanisms in place to enforce or even monitor compliance with the many rules and regulations around data and AI”, says Sander Klous. “In other regulatory domains, organisations like KPMG, as an independent third party, enable organisations to demonstrate their compliance through an auditing process. Unfortunately, this process is complicated in the domain of data and AI. Firstly, because it is hard to reach the necessary scale to audit all relevant applications. This could be addressed by automating large parts of the process, leading us to the second challenge: rules and regulations are extensive and complex. Take for example the General Data Protection Regulation (GDPR). It is rather voluminous with many grey areas that contain a wealth of issues for potential disagreement. At present, it is too complicated to translate into computer-interpretable policies. Verification of compliance needs to be done by human beings, prohibiting the required automation.”

Wherein lies the challenge?

“Auditors need to know what is allowed and what is not, what agreements are in place, what the rules are. You cannot check something if you do not know what to check against. The same holds for the organisations being audited. It is difficult to comply with the rules if you do not know what they are. In short: We need to know what good looks like. Then, if we all carry out our work according to the same specifications, statements can be made on compliance. The outcome of the work should become largely independent from the party that performs the verification. In the audit business this is a crucial step.

Automation of compliance to specifications is done through protocols. A good example is internet connectivity. The specifications on how to connect to the Internet are automated through the TCP/IP protocol. The semantics of policies that can be interpreted by computers, are reaching levels of richness and sophistication that allow for translation of most rules and regulations into computer-interpretable policies. Research by the University of Amsterdam and research institute TNO has demonstrated this. Once policy specification, monitoring and enforcement are embedded in protocols on the data analysis layer, the automated audit of compliance is within reach.”

Why did KPMG become an endorsing partner for AMdEX?

“AMdEX aims to become a national coordination point, stimulating initiatives to share data in a responsible way. Similar to what AMS-IX has done for connectivity. One of the crucial elements to make that effort a success are the independent verification mechanisms, as described above. Usually, audit and assurance parties are invited at a very late stage in the development process of such initiatives. Parties get together to create something. Once it is close to deployment in a production setting, they realise: ‘Oh hey, this thing needs to be audited’. By the time we do get invited, the product has been built and no thought has been given to audit and compliance. Because it is not the expertise of the parties that developed the solution. Trying to fix it as an afterthought is expensive, causes delays and leads to suboptimal results. We hope, as an endorsing partner of AMdEX, to avoid these situations by making sure features for audit and compliance are built into the protocols by design in a way auditors would like to see them.”

What is your data dream?

“I have many, but this is one. In one of my research projects, I teamed up with the Prinses Máxima Centrum, a hospital specialised in child oncology. We are working on DIPG (Diffuse Intrinsic Pontine Glioma), a rare type of brain cancer that occurs in very young children. Because it is so rare, it is hard to do any statistical analysis on the related data. Hundreds of hospitals worldwide started collaborating in the so-called DIPG registry, making their data available with unified definitions in a large globally federated database. Unfortunately, each hospital has its own rules on how and when this data can be accessed, making it hard for a researcher to analyse all that data. We are the prisoners of our own rules and regulations. With the mechanisms described here, we could facilitate this research by providing easy access to the data whilst being compliant with rules and regulations. I hope this will enable the necessary breakthroughs to treat this horrible disease.”

Text: Karina Meerman

KPN IoT signed endorsing partnership agreement

Left to right: Rutger Rienks, Carolien Nijhuis, Nina Tellegen, Willem Koeman.

Earlier, KPN IoT signed the endorsing partnership agreement with AMdEX. KPN offers the Data Services Hub, a platform-as-a-service for realtime exchange of information as the backend for emerging dataspaces. Together with AMdEX, they look forward to explore these new possibilities in e.g. the i4Trust and the DMI, a Dutch National Growth Fund project.

Want to know more about AMdEX?

Read more on AMdEX and the role of the Amsterdam Economic Board in this initiative. Your organisation can play an important part too! Becoming an endorsing partner is one of many ways to participate in the transition towards a fair data economy.