“Opt-in is where the value is,” says Tess Kolczek, chief privacy officer for E-loan. “That’s where you get a better return.”

Ponemon recommends asking customers directly what information of theirs would be a problem if it got into the wrong hands. There are the obvious answers: Social Security numbers, credit card numbers, driver’s license numbers, medication information and addresses. CIOs understand the privacy implications of releasing that kind of information. But CIOs might not view other information as sensitive, even though customers do. These could include life events such as a birth of child, anniversaries and birthdays, a job change or change in marital status. Companies may use such information to send out e-mail pitches associated with these events to promote a product or service, irritating customers or violating their own privacy policies.

The answers customers provide will give CIOs the information they need to categorize personal data as highly sensitive, somewhat sensitive or nonsensitive. Appropriate protections and policies can be developed for each category, with stricter security and privacy policies for the most sensitive and less restrictive for the not so sensitive information. “This helps build trust,” Ponemon says.

Once values are established for different kinds of personal data, the CIOs we talked to had specific processes that employees were required to follow to make sure the data is not misused or accessed inappropriately. At Boston’s I2B2, researchers are required to go through the patient’s health-care provider to obtain a patient’s consent for information that is not in the medical record, such as DNA. Researchers are not allowed to contact the patient directly. The data is then encrypted before it is sent out to researchers.

Still, once the data is released, there is no safeguard (other than fear of sanctions for violating HIPAA and the researchers’ professional word) that the data will not be released to third parties, such as pharmaceutical or insurance companies. “It comes down to only giving these things to people you trust,” Dr. Murphy says.

The same precautions the health industry follows can be employed in other industries. Bell Canada’s Giordano developed a list of privacy questions marketing managers at the telecom company must check off when new services and products are being developed and readied for marketing. Marketing managers must provide answers to such questions as how the personal data will be collected, with whom they will share the data, how the information will be stored and for how long. Giordano and sometimes a regulatory officer at the company go over the answers, and if any answers to the questions violate privacy policies or laws, Giordano works with the managers to rework the service to make sure the privacy policy is followed.