Unlike privacy officers in American companies, Giordano has a big stick to wield. In 2001, Canada passed a strict privacy law, which sets rules for how companies can collect, use or disclose personal information. For example, data cannot be stored indefinitely and can only be stored for however long it is needed. The law also gives Canadians the right to access and request correction of personal information. Companies cannot share information among affiliated companies unless they obtain permission first from customers.

Still, Giordano says Bell Canada’s marketing department was reluctant at first to discuss with company executives who oversee privacy the kind of personal information they had and how they intended to use it, fearing that they might be prohibited from continuing some marketing practices. So Giordano approached the marketing managers with the idea that he was trying to find ways to protect privacy but not necessarily say no to the use of this data. For example, Bell Canada collects customer consents for its four primary services—wireless, DSL, satellite broadcasting and wireline (a multi-channeled digital service that can service three TVs, high-speed Internet and telephony all at once). In other words, a customer gives the company permission to discuss marketing opportunities with them for any or all of these three services. An onscreen prompt reminds reps what they can and cannot discuss with customers who call in.

“The approach should be: If you give us more information, we can help you with what you are trying to do within the bounds of the law and our privacy policy,” Giordano says.

There’s much more companies can do to make privacy a top priority among employees. At Partners Health, the staff sees posters in the halls and elevators that remind them of the HIPAA regulation requiring them not to discuss patient data in public. E-loan’s Kolczek recommends that CIOs build a strong relationship with their marketing departments to keep them informed on new privacy laws, citations and how a new marketing practice may violate the privacy policy. “It can be a love-hate relationship,” she admits. “But marketing knows if something is done wrong, our relationship is at stake.”

Recently, Kolczek had to convince the marketing department that installing third-party adware on E-Loan’s website that could track a visitor’s viewing habits was something she felt violated E-loan’s promise to protect customers’ privacy. Marketing agreed not to install the software, she says.

The Carrot-and-Stick Approach

At Bell Canada, educating employees about privacy includes managers reviewing the company’s privacy policy and code of ethics with each employee during a performance review and discussing the rules governing use of data, access and disclosure of data, and how that relates to the person’s job function. The more access an employee has to customers’ personal data, the more time the manager spends on the review. Employees then are asked to sign a document pledging they understand the policies.