Podcast S9E3 | Female Oversight with Roosa Rosti

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:23
Welcome to Risky Woman Radio today’s risky woman is a senior consultant at Deloitte, specializing in data protection and privacy AI and internet regulation. She has a well rounded perspective on both the technical and human sides of the business through her background in legal services and customer support roles. Holding a master’s degree in data protection and privacy law from Dublin City University gives her a good foundation for navigating data protection and privacy frameworks and regulatory compliance. So welcome to Roosa Rosti!

Roosa Rosti 0:58
Thank you so much.

Kimberley Cole 0:59
Great to have you here, and I’ve given a very sort of short introduction, but we’d love to hear your career journey in your words and what some of the highlights were for you along the way.

Roosa Rosti 1:11
Yeah, of course. So I guess I’ll start from I studied law as an undergraduate in Dublin City University, but after graduating, I wasn’t really sure if I wanted to follow the kind of traditional solicitor, barrister route, so I went to work as a legal secretary in a law firm which was actually really valuable, because it gave me a really practical view of what legal work actually looks like, day to day. And while working there, I then discovered that Dublin City University had launched a master’s in data protection, privacy law, and I kind of always been interested in emerging technology, and the data protection space felt like that kind of space where law, ethics and innovation all get combined. So I went for that, completed it in 2020, and that then became the entry point into my current role and the digital trust and privacy team at Deloitte.

Kimberley Cole 2:06
Fantastic. I love that sort of journey that’s interesting.

Roosa Rosti 2:09
Yeah, it’s been really great so far, and especially now working at Deloitte, I’ve had a chance to work on a wide range of different projects across privacy and digital regulations governance, and it’s kind of given me that chance to see how all that regulatory theory that I learned about in college translates into the decision making process in reality, and then also, like how important the trust, accountability and good governance are when you’re scaling technology.

Kimberley Cole 2:38
And along the way, have there been sort of hard decisions that you’ve had to make a choice between doing one thing or another that really helped shape the direction that you’ve headed?

Roosa Rosti 2:48
I’d say the hardest decision probably was going back to education to complete the masters. I was already working full time as a legal secretary, like I said. So going back to college can meant more financial pressure, time pressure and maybe a little uncertainty as well, kind of starting again from scratch, but looking now in hindsight, it was really the turning point in my career, because it kind of gave me that door to where I am now, and also an opportunity to start building my network in their data protection space.

Kimberley Cole 3:16
Excellent. We love it when we, a risk it pays off. So well done! And what’s the best piece of advice that you’ve received so far?

Roosa Rosti 3:27
Oh, I’d say Whatever feels hard or scary. Do it go for it! Think it’s very easy to stay in your comfort zone, but once you get outside of that, the growth and progression kinda sit outside of it. So and also, if it doesn’t work out or go exactly as you planned, you’ll always have that experience behind you then, and I don’t think that’s ever a waste.

Kimberley Cole 3:48
Yeah, that’s very true. Good advice. When you think about your leadership, ultimately, when you’re thinking about what you would like to leave behind, what would be that change that you hope that you would leave behind in terms of people or culture or the profession itself?

Roosa Rosti 4:08
I’d say, I guess that advice that I just talked about kind of came from it. So I’ve had the fortunate opportunity to work with some really excellent leaders, a lot of them women as well, who’ve invested time in my growth and development. So I think I’d like to leave behind a strong culture of mentorship. As I progressed in my career, I’ve had opportunities also to mentor others that are at earlier stages of their careers, and I’ve seen really how powerful that support can be. So if I could help create environments where people feel supported and challenged and encouraged to grow. That’s the impact I think I’d like my leadership to have.

Kimberley Cole 4:46
Brilliant. We are looking at how we build up a coaching and mentoring circle network within Risky Women. So fantastic. Maybe we can get your help on that one. That would be great.

Kimberley Cole 4:59
That would be great.

Kimberley Cole 5:00
And when you think about emerging challenges in GRC, what do you think disproportionately requires women’s voices and leadership? This is one that we’re asking all of our podcast participants now.

Roosa Rosti 5:15
That’s a really good question. I think there’s a lot of talk about ethics and building ethical organizations at the moment, and I think that is one of the bigger emerging challenges in the GRC area as well. And I think that is an area where women’s leadership will be particularly important. I think women, from what I’ve seen, they often lead with a really strong focus on mentorship and wellbeing and collaboration, so that then makes people feel supported and valued and the ethical behavior kind of then becomes part of the culture in the organization, rather than just being a policy. And that culture will then flow down into how products are developed and how risks are identified and assessed, and ultimately how decisions are made. And that will then in turn, strengthen the governance, risk and compliance in the organization.

Kimberley Cole 6:03
Fantastic. Love it. Absolutely love it.

Kimberley Cole 6:08
This episode is brought to you by Kroll. Stay ahead with Kroll. As the leading independent provider of financial and Risk Advisory solutions, Kroll leverages their unique insights, data and technology to help clients stay ahead of complex demands.

Kimberley Cole 6:26
Now I forgot to mention, one of your biggest achievements was being a winner in the Risky Women Write competition! Well, at least from our perspective anyway, you probably have other achievements that are bigger. But anyway, so you wrote a fabulous article, which, of course, I recommend that everyone, if they haven’t already read it, goes online and reads it. But it was Female Oversight: the key to building ethical AI in femtech. So really interesting and hot topic. So let’s get more into that today. So let’s talk a little bit about femtech’s promise versus sort of the reality. It was really interesting and different article from our GRC space, and really well received. So you looked at the femtech rises to meet women’s health needs, that technology designed to empower women may just reinforce some of the outdated biases that we’re already seeing. So we’ll get into the detail. But with AI’s promise, the question was, will we truly transform femtech or merely dress up the same old disparities with the shiny new algorithms? Now you had some fantastic feedback from our judges. Here’s just a few of the comments was the article compellingly argues that formal female oversight is essential for ethical, competitive, AI enabled femtech. Whilst I might not agree with every point of view and suggestion, this is exactly why this piece is so good. It gets into the heart of a number of questions, representation, perspectives, lived experience, governance, data, ethics, etc, important areas where more ideas would accelerate collective good. Bravo! And then one more without intervention combining all of that with the femtech risks, embedding gender and social biases more deeply into the digital health infrastructure. So fantastic. Congratulations on your second prize win. And let’s start with what inspired you to write this piece and why it’s so important now?

Roosa Rosti 8:35
So I’d turn a personal level I have a huge interest in health and wellness and new tech in that area in general. So in that space, I’ve noticed that femtech was, or has been, really growing fast lately, and there’s so many more products coming out, and they’re really becoming more technically sophisticated. So that’s where my interest came from. But on the other hand, I’ve also noticed that femtech has had some privacy and security concerns and some high profile cases. So thinking about that in the context of AI, I was really interested to dig into what AI integration would mean for femtech, and also then how we could proactively prevent harm, rather than reacting to it later. And I think we’ve all seen now that AI is moving incredibly fast, and a lot of companies are under pressure to scale and automate. So if we don’t pause now and look at who’s signing these systems and whose data they’re trading on and who’s accountable if and when any harm occurs, there’s a really high chance of locking in these inequities that will then be very hard to undo later on.

Kimberley Cole 9:42
Yeah, absolutely. And femtech is often described as empowering women through data. So in your view, what is femtech doing well today, and where is it still sort of falling short?

Roosa Rosti 9:56
So like I mentioned, femtech has recently moved beyond these very basic what used to be, I guess, period tracking apps into addressing real medical needs and giving more personalized insights to women. And they’ve also through that helped to normalize conversations about what were historically taboo topics like fertility struggles, the menopause and postpartum mental health, PMS, so the women now have better language on the data to back it up, so they can then advocate for themselves in the healthcare setting. And some of the areas where I think femtech still falls short is around data protection and surveillance risks and inclusion. So the data they collect is really sensitive, and especially in some legal and political contexts, there is a chance that it could be misused. And there’s also, like I mentioned, there have been some high profile cases where the data generated through femtech apps was shared without the meaningful consent of the users, and then on top of that, the data that goes into the femtech is often very narrow. It’s reflecting this Western, wealthier population, which can then, when combined with AI, lead to inaccuracies for women from different cultural or socio economic backgrounds. And I’d say the final shortfall maybe, for femtech At the moment this, it’s still a very kind of private stack of tools for women, so it’s very consumer funded and still disconnected from the traditional healthcare setting, so that can also then contribute to lower income women being excluded from having the ability to use femtech.

Kimberley Cole 11:37
All great points, and I think you’re right. There’s so much more emphasis now and awareness and so many things happening in the space. I have a very good friend, Maaike Steinebach, who’s in Hong Kong, who has another podcast called Femtech at Work, which I would recommend everyone listen to as well if they want to hear more about this space. She’s had some fantastic guests who are doing some really innovative things in the space. So that’s really, really another interesting channel. You opened the article with the idea that AI might simply dress up old disparities with these new shiny algorithms. So what kind of prompted you or led to that concern?

Roosa Rosti 12:17
So I saw somewhere that AI was described as kind of a rear view mirror, so it means that it learns from where we’ve been, but not where we want to go. And I think that was very fitting for femtech and healthcare, because in those settings, this rear view is a medical research history that’s very much where the default male was standard for decades, and that’s been baked into the foundational data that’s used then to develop AI and fed into the femtech using AI.

Speaker 1 12:47
Yeah, women we’re just consider to be small men.

Roosa Rosti 12:51
Yeah, exactly, exactly. So if an algorithm is trained on 50 years of that kind of data, including like where women’s pain was dismissed, or their symptoms weren’t tracked, or women weren’t included at all, the AI itself isn’t going to fix that bias. It’s just going to learn it as being normal.

Kimberley Cole 13:09
Yeah, absolutely. So that’s a really good point. I mean, have you got any examples of the real world consequences of that male centric approach, and how that gender data gap has caused issues?

Roosa Rosti 13:25
I’ve recently read something that a lot of women that present in emergency departments thinking that they have heart pain or chest pain or they might be having a heart attack, they’re just completely dismissed as having anxiety or stress, and that’s leading to bad outcomes for them because they’re not being pushed forward for the right diagnostics, just because this data from the past says that women are less likely to have heart conditions compared to men.

Kimberley Cole 13:51
Absolutely. So let’s look at governance and female oversight and all of those other things that you talked about. So you argued for governance by design. What does that look like in practice for femtech companies?

Roosa Rosti 14:04
It’s very similar to the concept of privacy by design. So I think governance by design means it’s not a checklist at the end. It’s built into the products, from how they’re conceived, how they’re trained, tested and ultimately deployed. So in practice, for AI, that means setting very clear accountability, and not just performance metrics. It means that you’re documenting assumptions and data sets. You’re doing stress testing on the models, also on the edge cases, and then also having escalation paths where harm occurs. And I think it also means kind of slowing down at those key moments and thinking that not every feature that you want to push out needs to be deployed just because it can. And I think sometimes restraints could be the more responsible design choice.

Kimberley Cole 14:53
Interesting and your idea of sort of female oversight, it goes beyond user testing. What does that meaningful oversight actually entail?

Roosa Rosti 15:04
So it means giving women the power, not just having them participate. So it’s asking women for feedback after decisions are made, making sure women are in roles where they can influence what gets built, what data is used, and what trade offs are acceptable to them. And includes putting women in leadership advisory boards and data science ethics review and also at the executive level. And I say, most importantly, it needs to have some teeth. And if the concerns aren’t raised, there needs to be some kind of mechanism put in place to pause, revise or stop deployment, and not just see, okay, there’s a risk. Let’s move on. And I think without that power, the oversight is just very symbolic, but with it, the governance will actually work.

Kimberley Cole 15:50
Yeah, excellent points, and some are obviously going to question whether governance needs to be gender specific. But why do you argue that female oversight is essential and not just a nice to have?

Roosa Rosti 16:03
So I’d argue that it’s because the default systems that we’re inheriting, they were never neutral, and they were very male specific. They’re built in environments where women were underrepresented. So female oversight is about correcting that and bringing the perspective that were historically missing from this medical research. And it’s also means bringing in women’s lived experiences. And if we don’t bring it in, then we’re effectively asking these same systems that created the problems to fix themselves. And I think it’s not about excluding men, I’m not saying they don’t have valuable contributions. But I think in fan tax specifically, it would be very contradictory not to have this gender aware governance, like if the product itself is about women’s bodies, then women should have that authority over how the products work.

Kimberley Cole 16:55
Yeah, absolutely. And you kind of frame good governance as not only ethical, but also commercially strategic, which I think is important. So how can inclusive oversight actually build that trust and build that sort of competitive advantage in the market?

Roosa Rosti 17:11
So we’ve seen it with consumer tech in general, that trust is the real currency there, and I think especially in time tech, where users will share extremely sensitive data. Once that trust is broken, it’s very difficult for these companies to regain and companies that invest in inclusive governance, they’ll tend to catch these issues earlier and avoid the scandals and build products overall. And I think they’ll retain their users for longer, because the users can tell that the product is made with them rather than on them. And looking at it from a business perspective, they’re always very short term gains, it’ll always catch up, whereas you want to build that long term value from building credibility and safety and aligning with what the user wants.

Kimberley Cole 17:59
Absolutely and yeah, I mean, trust comes up time and time again on all of the different topics that we talk about on the podcast. So I agree, and absolutely that makes you commercially viable, even to gain that competitive advantage. So I think that’s a fantastic point. If you could thinking about it, implement just one change so you’ve got your magic wand to ensure that AI truly advances rather than undermines women’s health. What would it be?

Roosa Rosti 18:29
Oh, I would say very similar to data protection impact assessments under the GDPR, I would require mandatory independent impact assessments for AI driven femtech products before they’re put into large scale deployment. And those would look at things like gender bias, the data gaps, and the unintended harm, and be kind of a condition to progress with the development. And I think that will really feed into the fact that if you can’t explain who the model works well for and for who it doesn’t, then you’re not ready to deploy it. And we’ve seen it, I think, with the data protection impact assessments that helps companies have better data practices overall, and they make better decisions and have better accountability. So I think ultimately that would then move us closer to femtech that will actually deliver on what they promise?

Kimberley Cole 19:20
Fantastic. Look. I mean, it’s a really interesting topic. I love how you are looking at other models and bringing them into femtech, talking about data, talking about commerciality, trust being a big one. So some really great points. So once again, I suggest everyone reads the article and let us know what your ideas are and your thoughts are. Now another question that I’m asking all of our participants on the Risky Women Radio this year is our winner wrote an article which was the obituary of the risk matrix, and we thought it was just such a fun idea. So if you had to write the next obituary for an outdated tool or practice in governance, risk or compliance, what would it be?

Roosa Rosti 20:10
That’s a really good question. I would think the next obituary would be for this concept of checklist compliance. We’ve seen it and especially in the digital regulation space. At the moment, with this volume and pace of new regulations, it’s not really realistic anymore to treat compliance as this box ticking exercise, and I think that approach itself creates kind of like a false sense of safety, so you could technically be compliant while still missing the real risks in the organization, like how a system behaves in practice, or how decisions are scaled, or where the harm actually will come from in the business context, so that could be replaced with maybe a more risk based contextual way of thinking, so understanding why these compliance requirements exist and how they map to a business model and where the real exposure for the company lies.

Kimberley Cole 21:03
Excellent. I think we’re going to end up with a whole list of things that will be quite transformative. So thank you for your idea. So now to have a bit of fun to wrap up this episode, we have our rapid fire round. It’s new set up for this season, and we’re asking everyone to do these one word pick and choose ideas, and then we’ll get into a few one word answers from you. So let’s see how we go. Okay, risk taker or risk averse?

Roosa Rosti 21:36
I would say risk taker.

Kimberley Cole 21:38
Excellent. Head or heart?

Roosa Rosti 21:41
I’m gonna say a heart.

Kimberley Cole 21:44
Courage or caution?

Roosa Rosti 21:46
Caution.

Kimberley Cole 21:47
Principles or pragmatism?

Roosa Rosti 21:50
Pragmatism.

Kimberley Cole 21:51
Culture or controls?

Roosa Rosti 21:53
Culture.

Kimberley Cole 21:54
Instinct or evidence?

Roosa Rosti 21:57
Evidence.

Kimberley Cole 21:58
And legacy or impact?

Roosa Rosti 22:01
Oh, good question. I think impact.

Kimberley Cole 22:05
Great! And what’s your leadership superpower?

Roosa Rosti 22:09
I think it goes back to that mentorship, kind of looking out for the next generation of people coming up behind me and making sure that I’m passing on what I’ve learned in my career so far onto them. I think that’s the only way to bring up more people into the space.

Kimberley Cole 22:24
Fabulous. What’s one word that defines your career so far?

Roosa Rosti 22:28
Not really a one word, but I’m gonna say an exciting journey.

Kimberley Cole 22:34
Excellent. And governance in one word.

Roosa Rosti 22:37
Oh, governance. Important.

Kimberley Cole 22:41
Excellent. And what’s the future of GRC, either in a single word or a short phrase?

Roosa Rosti 22:49
I think it has to be automated. There’s been a lot of manual processes up until now, but we’re seeing it move towards that space. I think.

Kimberley Cole 22:58
Excellent. And that’s a wrap for rescue and radio, but thank you so much for number one, entering the Risky Women Write competition. Thanks for bringing us new thoughts and new ideas around femtech and governance, risk and compliance, and for joining us on the podcast today.

Roosa Rosti 23:18
Thank you so much. Kimberley.

Kimberley Cole 23:20
Brilliant. Thanks a lot, Roosa and thanks, and we will speak again soon.

Kimberley Cole 23:26
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org