CIO —

Part of my consulting work is as an expert witness, working with lawyers as a forensic CRM analyst. These cases usually involve mergers, reseller agreements, and breaches of contract. But they may also involve wrongful termination, customer privacy issues, trademarks, and compliance issues. For an analyst who knows what they are doing, your CRM system holds a wealth of discoverable clues that can be turning points for lawsuits.

For any modern marketing and selling organization, CRM is as essential as an accounting system. But most organizations don't realize the value and the scope of the data their CRM represents. You need to understand the policies and the best practices to keep your compliance and legal discovery issues to the absolute minimum. Get this on your agenda pronto.

Financial and Personal Data

At the top of everyone's list should be the customers' financial information. The best way to avoid PCI audits and headlines about credit card lists leaking to the internet is to not store that data in the CRM system in the first place. Although your customer service reps (CSR) may need to access that data, the CRM system should hold only pointers (external keys) to the system of record for credit card numbers, bank account numbers, payment history, etc. A good integration broker can bring that information over for real-time display purposes only — this is where a browser UI and Web 2.0 mashups really shine. If you must cache some customer-sensitive information in the CRM system, truncating the fields ("last four digits of your social") is the least you can do: multiple obfuscation techniques should be used in tandem.

It's more than just those obvious financial data. In insurance and medical records, add HIPAA. For education and government markets, there's FERPA. Add your favorite acronym here — it all adds up to the need to protect your customers' (and in some cases employees') personal information.

And then there's Europe. U.S.-based readers may not realize the European Community's personal information protection rules are much tighter than those out of Washington, and some member countries have even tighter privacy regulations than the EC. Even though these privacy laws are intended to protect the information of "natural persons" (consumers), if you sell B2B you have to be aware of the requirements with respect to your customer's European employees...and your own. EC Directive (95/46/EC Chapter IV) indicates that the personal information cannot be transported or processed outside of the EC unless the country it's being processed in has privacy laws at least as stringent as the EC. Lovely. The good news is, there are several ways to resolve this. But you'll definitely need to consult your attorney regarding compliance strategies.

Continue Reading