The Profits in Customer Privacy

1 2 Page 2
Page 2 of 2

The answers customers provide will give CIOs the information they need to categorize personal data as highly sensitive, somewhat sensitive or nonsensitive. Appropriate protections and policies can be developed for each category, with stricter security and privacy policies for the most sensitive and less restrictive for the not so sensitive information. “This helps build trust,” Ponemon says.

Once values are established for different kinds of personal data, the CIOs we talked to had specific processes that employees were required to follow to make sure the data is not misused or accessed inappropriately. At Boston’s I2B2, researchers are required to go through the patient’s health-care provider to obtain a patient’s consent for information that is not in the medical record, such as DNA. Researchers are not allowed to contact the patient directly. The data is then encrypted before it is sent out to researchers.

Still, once the data is released, there is no safeguard (other than fear of sanctions for violating HIPAA and the researchers’ professional word) that the data will not be released to third parties, such as pharmaceutical or insurance companies. “It comes down to only giving these things to people you trust,” Dr. Murphy says.

The same precautions the health industry follows can be employed in other industries. Bell Canada’s Giordano developed a list of privacy questions marketing managers at the telecom company must check off when new services and products are being developed and readied for marketing. Marketing managers must provide answers to such questions as how the personal data will be collected, with whom they will share the data, how the information will be stored and for how long. Giordano and sometimes a regulatory officer at the company go over the answers, and if any answers to the questions violate privacy policies or laws, Giordano works with the managers to rework the service to make sure the privacy policy is followed.

Unlike privacy officers in American companies, Giordano has a big stick to wield. In 2001, Canada passed a strict privacy law, which sets rules for how companies can collect, use or disclose personal information. For example, data cannot be stored indefinitely and can only be stored for however long it is needed. The law also gives Canadians the right to access and request correction of personal information. Companies cannot share information among affiliated companies unless they obtain permission first from customers.

Still, Giordano says Bell Canada’s marketing department was reluctant at first to discuss with company executives who oversee privacy the kind of personal information they had and how they intended to use it, fearing that they might be prohibited from continuing some marketing practices. So Giordano approached the marketing managers with the idea that he was trying to find ways to protect privacy but not necessarily say no to the use of this data. For example, Bell Canada collects customer consents for its four primary services—wireless, DSL, satellite broadcasting and wireline (a multi-channeled digital service that can service three TVs, high-speed Internet and telephony all at once). In other words, a customer gives the company permission to discuss marketing opportunities with them for any or all of these three services. An onscreen prompt reminds reps what they can and cannot discuss with customers who call in.

“The approach should be: If you give us more information, we can help you with what you are trying to do within the bounds of the law and our privacy policy,” Giordano says.

There’s much more companies can do to make privacy a top priority among employees. At Partners Health, the staff sees posters in the halls and elevators that remind them of the HIPAA regulation requiring them not to discuss patient data in public. E-loan’s Kolczek recommends that CIOs build a strong relationship with their marketing departments to keep them informed on new privacy laws, citations and how a new marketing practice may violate the privacy policy. “It can be a love-hate relationship,” she admits. “But marketing knows if something is done wrong, our relationship is at stake.”

Recently, Kolczek had to convince the marketing department that installing third-party adware on E-Loan’s website that could track a visitor’s viewing habits was something she felt violated E-loan’s promise to protect customers’ privacy. Marketing agreed not to install the software, she says.

The Carrot-and-Stick Approach

At Bell Canada, educating employees about privacy includes managers reviewing the company’s privacy policy and code of ethics with each employee during a performance review and discussing the rules governing use of data, access and disclosure of data, and how that relates to the person’s job function. The more access an employee has to customers’ personal data, the more time the manager spends on the review. Employees then are asked to sign a document pledging they understand the policies.

And, of course, all of these companies monitor who accesses customers’ personal data. At Bell Canada, a rep who accesses a customer account without that customer having called in may be flagged for review. In addition, the company controls access to customer data on a need-to-know basis. Almost all access to personal data is limited to those employees who have direct contact with the customer. Giordano is working the Bell Canada’s CIO to develop an application that pops up a message warning employees if they access information they should not. If the employee proceeds, the CIO and appropriate manager will be alerted.

If someone in the company does violate the data use policies, company privacy experts say action must be swift and appropriate to the violation. At companies interviewed for this article, punishments ranged from reprimands and transferring an employee to a less sensitive job to dismissal.

As these examples illustrate, there is much that CIOs can do to take a proactive stance on privacy. The last thing their companies want is to be a sitting duck for the kind of disaster that tarnished CartManager’s reputation. After the FTC citation, CartManager was sold to new owners, Vision Bank Card, who immediately instituted a stronger privacy policy. The policy now explicitly states no customer information will be sold to third parties. The FTC also ordered CartManager to provide “a clear and conspicuous disclosure” that consumers are entering their credit card and other personal information on CartManager’s website, not the original merchant’s website.

“We’ve changed our policy,” Hill says. “We now take privacy very seriously.”


Copyright © 2006 IDG Communications, Inc.

1 2 Page 2
Page 2 of 2
Discover what your peers are reading. Sign up for our FREE email newsletters today!