Just two days after it listed on the New York Stock Exchange, the mainland’s Didi Global (DIDI) was hunted down by Chinese authorities, allegedly for its poor management of users’ data. This is the first such case made public by the country’s Cybersecurity Review Office, which cited national security concerns over the Didi Chuxing app’s data collection and use.
Following the investigation, the Didi app was made unavailable on app stores, to stop it from signing up new users. Didi Global’s share price crashed 30% since the news came out last Friday (July 2, 2021).
While the market is seeking clarity in the ongoing investigation, there are some takeaways from this episode – not just for Didi, but for other tech giants, especially around environmental, social, and governance (ESG) risks. Here are three lessons.
Lesson 1: Legal Business =/= Ethical Business
First, internet businesses are very young and fast evolving. Regulatory coverage is still under development and is still slow to keep up with constant changes. That is why on paper, internet companies have far less involvement in regulated activities, compared to a utility provider or a property developer, as an example. But this doesn’t mean these companies are immune to regulatory scrutiny, which could tighten at any point.
To safeguard against this, a more relevant way to invest is to identify companies that have been upholding ethical standards, rather than sticking to the bare minimum of legal compliance. Most of the time regulations are less strict than society’s ethical values.
Lesson 2: This Risk Is Expensive
Unlike measuring volatility in the market, non-financial risks are difficult to quantify. But, with the benefit of hindsight, the impact of non-financial risks weighs on a company’s financials, and investors can be on the hook for big losses.
For example, Facebook (FB) has been scrutinized by U.S. and EU regulators for its approach to privacy management, receiving a historic US$ 5 billion fine from the U.S. Federal Trade Commission in July 2019. This fine directly impacted the company’s financials. In addition, data from Sustainalytics shows that data-related breaches resulted in an average cost of US$ 3.9 million in 2019.
At this stage, privacy regulations are still emerging, and costs associated with compliance as well as cyberattacks are rising. An increasing amount of data being stored and processed in cloud computing environments also promote data privacy risks and costs.
Lesson 3: It’s Not Just Didi
Sustainalytics’ data shows that companies providing software and internet services are more vulnerable to data privacy and security than any other industry. This is obvious, thanks to the innate underlying business. Internet businesses can draw in massive amounts of data in the blink of an eye, and these companies directly or indirectly monetize the collection, processing and storing of sensitive user and client data. Thus, at the same time, risks of compromised accounts, misuse of personal information outside of agreed use, unlawful data sharing practices follow.
While the newly-listed Didi is not yet within our coverage universe, some of our favorite apps like Facebook, Snap Inc. (SNAP), Twitter Inc. (TWTR),and Uber Technologies Inc (UBER) have been found to be vulnerable to this issue. A case similar to Didi’s happened to its overseas peers Uber and Lyft. Precedent examples abound and these risks are unlikely to end with Didi. To top it all, as this specific risk isn’t confined by geographics, it makes sense for investors in tech companies to be mindful of such loopholes.
To end, data protection is a major loophole for the internet business and can translate into financial losses. It represents one facet of the numerous non-financial risks. When factoring in ESG issues exposed to a portfolio, investors should look from a broader perspective in ensuring a comprehensive and objective assessment.
©2021 Morningstar. All rights reserved. The information, data, analyses and opinions presented herein do not constitute investment advice; are provided as of the date written, solely for informational purposes; and subject to change at any time without notice. This content is not an offer to buy or sell any particular security and is not warranted to be correct, complete or accurate. Past performance is not a guarantee of future results. The Morningstar name and logo are registered marks of Morningstar, Inc. This article includes proprietary materials of Morningstar; reproduction, transcription or other use, by any means, in whole or in part, without prior, written consent of Morningstar is prohibited. This article is intended for general circulation, and does not take into account the specific investment objectives, financial situation or particular needs of any particular person. Investors should consult a financial adviser regarding the suitability of any investment product, taking into account their specific investment objectives, financial situation or particular needs, before making any investment decisions. Morningstar Investment Management Asia Limited is licensed and regulated by the Hong Kong Securities and Futures Commission to provide investment research and investment advisory services to professional investors only. Morningstar Investment Adviser Singapore Pte. Limited is licensed by the Monetary Authority of Singapore to provide financial advisory services in Singapore. Either Morningstar Investment Management Asia Limited or Morningstar Investment Adviser Singapore Pte. Limited will be the entity responsible for the creation and distribution of the research services described in this article.
.jpg "Kate Lin")
