The Journey to GDPR Compliance

As the GDPR deadline approaches, staffing firms are scrambling to implement cultural and process changes. Not Yvette Cleland (well, maybe just a little). As CEO of Clinical Professionals, it’s her job to get ahead of the game and explore the impact on her own internal team as well as her clients.

The RIX team joined Yvette for a discussion about the challenges and opportunities arising from regulatory compliance demands.  Tapping into her insights working within the heavily regulated life sciences industries, Yvette shares her advice on how to start preparing now and also how to collaborate with associations and business partners to advance the cause.

RIX: Let’s start with something that is super exciting and everybody’s favorite part of the current world—regulations. What do you see as being the biggest changes and the biggest concerns for staffing firms in the UK and Europe currently?

Yvette Cleland: My problem is twofold because the market we recruit into is incredibly regulated, and now the staffing industry is going that way. Not only are we dealing with GDPR process changes there, but Brexit will drive regulatory changes within life sciences, so I’m going to have to deliver a double whammy at the same time.

First up is GDPR, and we’ve got a lot to sort out, as an industry and as a company. We’re still waiting for the UK statute and data exceptions and more guidance on how the information commission officers are going to oversee and enforce it. So my approach is to track backwards and ask, “What do I have to do to keep my company safe, keep the people within it safe, and make sure I avoid becoming the case law example?”

RIX: What are the main challenges you’re dealing with internally?

YC: We realize that we will have to heavily amend our system processes and our company culture to ensure compliance. One key area we’re focusing on is developing new data portability processes. Keep in mind this is coming from a company that’s already unusually compliant. To be good at what we do, we have always expected a certain standard in terms of the amount of information we require to be in our CRM system. I’ve already pushed that to the nth degree, and I’m going to need to up it again to handle GDPR and industry changes.

RIX: Are there any new related business threats you see on the horizon?

YC: Yes, I’m tracking scenarios that would make it difficult for us on the back end if we are fully compliant working with somebody that is not. There are vast differences between how one talent company works versus another. I understand that it’s different for businesses of certain scales that may not have a properly set up sourcing model; sometimes they can’t even track their data or candidates that we send. It’s a far broader problem than we think, and it will require a huge culture change. It’s going to cause a lot of turmoil in businesses that are trying to get to a 60% – 80% direct staffing model.

We’re also concerned about charlatans that ask professional staffing companies to send candidates for jobs that aren’t real. We end up generating a candidate pool for roles that suddenly get placed “on hold” or “didn’t get sign off.” Six to eight months later, those roles go live and the firms already have a pool of highly qualified candidates. I think the whole industry is going to have to look at their processes to determine how to address these threats.

RIX: So how will CRMs need to be altered?

YC: We have a project team working on that issue at the moment to make sure that consent really is given, but there is not enough clarity yet to fully evaluate it for different scenarios. When you look at attribution from different sources like LinkedIn, it gets into an even more difficult ball game. The companies we work with may not themselves be well set up to deal with these issues.

We are, in the background, doing as much as we can do to fully understand and implement best practices early so when the alarm goes off in May next year, we are already as compliant as we can be.

One of my main goals is that we are not one of the case law examples that establish what happens as we move ahead.

RIX: You are a member of APSCo, and I assume talking to other people in the industry about GDPR and its implications. What is your sense of whether there is a common consensus about GDPR and how it will be applied and what the impact will be?

YC: What always gets me, and it’s not just staffing—I deal with a lot of really large corporations—is how woefully unprepared some of them are. Because I’m the one who ends up leading the effort on big legislative changes and because I’m a real “Panic Pam,” I overprepare to get ahead of the game.

What APSCo does do that is very good is give constant feedback to the industry by way of a board reporting tool that flags the main things that you should be doing to keep yourself watertight. In the background, they are constantly lobbying and trying to find out more information so we can all be better prepared. They’ve done a really good job communicating clearly the things we should be doing, so if you are a massive organization or a little one, you can make sure that you are compliant.

But I know what is it like being in front of a busy business and there’s always this one thing you never quite get around to. It’s shocking, really, how many businesses aren’t prepared. Some of the largest pharma businesses in this country and globally are only just now getting around to having a good old think about it. I would have hoped because of the amount of data associated with clinical trials they would have been ahead of the game, but they’ve overlooked more basic applications around in-house talent processes.

RIX: It sounds like you are further down the lane in terms of getting ahead of the legislation. What things would you recommend that those who are not as far along should be doing?

YC: The simplest things are the ones you can control. If you already know that your business is non-compliant, you should be working towards that standard. This is not something that can be implemented overnight. In 2017 if you are not getting your systems prepped and your staff really well trained in the new processes, then you start doing that and measuring compliance now.

Years ago when the worktime regulations were implemented, we were compliant six months before it happened. We had already implemented it, tested it, found out where we buggered things up, and righted it, so from day one it was an embedded working practice. We also worked alongside the company that at the time provided our recruitment software, and we discovered that they were a little bit behind the curve. But when it did happen, we were a little bit ahead of the game.

You also need to be going out to the LinkedIn’s of this world and finding out what their stance is and what they are going to be doing. I think that is really important, because all the time that you are doing that you are also learning.

RIX: Speaking of LinkedIn, as well as job boards and sourcing sites, when you’ve engaged with those types of companies have you been pleasantly surprised by the actions that they are taking around GDPR?

YC: It is quite mixed and I think some of the more U.S.-centric job boards seem a little behind the curve… but I’m not going to name names! I think it’s in part because of the grey areas, but they’re saying “we’ll find out what happens,” which isn’t good enough.

RIX: The ambiguity is left court for everybody sometimes but agree there is enough there to get started. Turning back for a moment to APSCo and trade associations, I’m curious what you are hoping to both get and give as part of those memberships?

YC: My driver to be part of trade associations, both within and outside of staffing, is to add value to my client’s experiences and my candidate’s experiences. Just being a good staffing business doesn’t cut it. So I started working very deeply within core trade associations, and I started writing about those changes and informing the industry about our take.

Five years ago we also developed a salary survey that has evolved into a hardback book that gets turnout from six and seven thousand decision-makers. I wanted something to stay on peoples’ desks, because nothing stays on your desk anymore! The one thing that fascinates everybody is “am I remunerated enough?” We now have thousands of people emailing us and saying “is it out yet; I need to do my budgets; I need to understand where the shortages are; I’ve got this year’s version, can you just run through and tell me if it is up-to-date, etc.”

I allow all the associations to advertise free of charge, so they reach a wide audience and see us as a partner within the industry, as opposed to one of this dreadful staffing agencies that is there to rip them off. Alongside that we have built leading analytical reports and launched our academy program to create skills for the industry, which we feed back through trade associations to work on training and development. In all of those areas of work I am giving something back to the industry to which I charge a fee. And it puts you in the same room as your influential client, not as a staffing firm but rather as a peer who happens to have a high level of expertise.

RIX: So it keeps you busy! Outside of the regulations, what do you see as being the biggest challenges and the biggest opportunities in the industry? It sounds like you still are excited and get inspired by the industry. What fuels that for you personally?

YC: I’ve worked within the pharmaceutical industry for a number of years, so I am very knowledgeable and passionate about it. I never let my industry knowledge slip. So if I go in to speak to a Chief Medical Officer I can speak on a peer-to-peer level with them. I am going out to the U.S. in a couple of weeks to moderate a Chief Medical Officer meeting, which is a great compliment.

So what do I find exciting? With all the massive new developments in data science, AI, and machine learning, the way clinical trials are conducted is going to change, and we will be ahead of the market in terms of the candidates required to fill those up and coming roles. What I love is if you really understand the industry in which you work, your strategy can outpace everyone.

I went to a meeting with the Association of the British Pharmaceutical Industry (ABPI) a few years ago. They had been doing two year’s work of surveying on staff movement. And I put my hand up and said, “I’ve got all of that,” and they said “I don’t think so.” Not only have I got all of that, but I’ve got all of the information you just spent two years placing but mine is real. I love the world of big data, and we hold a lot of information that we can share.