Privacy at STAKE.

Access to personal data and how it's handled has always been a sensitive issue, but the development of the Internet has heightened concern. Yet, information is the lifeblood of the modern economy. The question is how businesses can recognize the individual's right to privacy while retaining the ability to collect and use information intelligently.

"YOU HAVE NO PRIVACY anymore," said Sun Microsystems CEO Scott McNealy. "Get over it." But few are willing to leave it at that. Different views and laws covering privacy rights are generating heat on both sides of the Atlantic. Governments of European Union nations have enacted restrictions on data transmission and content on Internet Web sites, whereas the U.S. is often conflicted about privacy vs. free speech.

According to recent surveys, most Internet users describe privacy as one of their major concerns, yet a majority readily provide personal data on a regular basis. It's not clear whether they're worried about infringement due to personal experience or because news coverage has spurred anxiety. The Clinton administration and the FTC have recently announced a privacy policy that advocates the "opt-out" approach. Companies are permitted to release any and all personal information unless specifically told not to by a consumer. The problem is, most people lean toward the "opt-in" approach. "Users want the 'Golden Rule' of the Internet to be: 'Don't do anything unto me unless I give you permission,"' Lee Rainie, director of the Pew Internet & American Life Project, told MSNBC.

The battle over privacy will likely play out over two rounds, according to Forrester Research, which has studied the issue. An initial round of legislation focused on Web sites will be passed next year; the issue will go into remission for a year or two after that followed by a second, broader round of legislation in 2005. The legislation will require all companies to post information practices, with the FTC retaining authority to take action against those that don't comply. It will almost certainly require consent for the sharing of data. What's less clear is whether industry lobbying will defeat measures requiring companies to provide consumers with access to the information collected about them.

In the following roundtable conducted in partnership with Acxiom, a Little Rock, AR, data integration services firm, CE gathered CEOs and CPOs (chief privacy officers) from Internet, software, marketing, retail, medical, security, banking, and insurance industries to examine the impact of privacy concerns on the flow of information and how businesses can get ahead of the curve. The discussion centered on ways companies can prepare to honor customer concerns and to what degree technology can help compliance. Acxiom CEO Charles D. Morgan and the Privacy Council's Gary Clayton mapped a six-point manifesto that companies may consider adopting as a working privacy philosophy.

J.P. Donlon

Here's Looking at Everybody

J.P. Donlon (CE): It might be interesting to share a snapshot of where we are: A Web privacy rating company called Enonymous.com did a survey last spring of more than 30,000 Web sites over a nine-month period. They rated sites' privacy policies from zero to four stars, based on the site's behavior regarding user contact and data sharing, and third party use. And 3.5 percent, or just over 1,000, qualified for the four-star rating, which means they never share personally identifiable information with third parties, period. Three stars, which signified a policy of sharing only with user's permission, went to 799 sites. Two stars were given to 2,500 sites, the ones that would contact users without permission, but only share data with permission. One star was given to 2,251 sites that share data without permission, and zero stars, meaning the site had no privacy policy at all, went to 22,000 sites, or about 73 percent of the group.

That looked pretty awful until I learned that two years ago, only 1,400 even posted the policy on privacy at all. So there's a movement, but the question is, where is it coming from? Is it being driven by politicians? Are you hearing it from your customers? Because people say, "Yes, we're concerned about privacy, in all these surveys we read--and yet blithely go on and divulge all kinds of information. Charles, perhaps you could frame this in terms of the business issues.

Charles Morgan (Acxiom): I thought it would be a good idea to begin with an explanation of the perspective that I have and some key points. We have been in the information and information management business for about 30 years, and have been extraordinarily interested in this topic for a long time because our financial services, our insurance company, and our other customers in traditional direct marketing from time to time had issues. And as the manager of large-scale databases, we knew that if we ever violated privacy it would be a real business issue for us, so we've trained our Acxiom associates and had a privacy policy for years.

I talk to customer executives. A few years ago, a few of them were interested, and today all of them are interested. I actually joked to one top executive banker, "I'll bet you have to go to a privacy meeting about once a month or so now, don't you?" He said, "What do you mean? Once a day." [Laughter]

Today, consumer privacy concerns every company that has customers. The Direct Marketing Association has been very proactive in trying to establish and set policy. We have the Privacy Promise, which is really one documented privacy policy for the use of customer information. The association stepped out a few years ago and made it a condition of membership.

But I think everybody expects more legislation to be passed. It's probably just beginning on a national basis, on a state-by-state basis.

It's interesting that all the principles we're talking about with privacy today were initiated in the Richardson Report, which was prepared for the U.S. Department of Education and Welfare back in 1963. So these are not new ideas, they're just newly on our minds. The report identified four areas that are still at the heart of the matter, and they are: notice, choice, access, and security.

Notice simply means informing consumers about the ways in which their personal information will be used. Choice means letting them decide where they want their information to be used for specific purposes, other than inside the company, such as trading that information or selling it.

Access allows consumers to review the information a company possesses, and potentially allows them to correct errors. And the last thing is something we all feel strongly about, and that is security of information.

I think it's important for everybody to understand that if the flow of customer information and prospect information was stopped or severely restricted, it would virtually paralyze this economy. Our economy literally is founded on the use and inflow of information. Customer information is one of the things that fuels our economic engine. It's what allows businesses to offer credit with reasonable assurances that the moneys are going to be repaid. But clearly there's got to be a balance between the use of this information and people's privacy.

Europe has a much more restricted flow of consumer information, and in a way I think consumers, though they've gained some in privacy, have suffered somewhat in terms of higher interest rates on credit cards. Some people in Europe would argue that the slower economic growth that they've suffered compared to the U.S. in the last 15 or 20 years may be partially a result of this restricted flow and use of information. Bad debt on credit cards is higher, fraud losses are two times as high, because the accurate identification of consumers is much more difficult. And, on the marketing side, the companies spend $20 more to acquire a new credit card holder in the U.K. and Europe than they typically do in the U.S.

So in the U.S. we've given up a little bit of personal privacy, but this freer flow of information has allowed us lower cost for goods and services. And we're, in effect, trading some privacy for economic benefits.

Expressing this idea of balancing risk and return, this is an analogy that I've used several times: There's a very large inherent risk in having a 70-mile-an-hour speed limit on the Interstate, because we know that about 40,000 or 50,000 people die in automobile accidents each year. But we've decided that 70 miles an hour and 41,000 deaths is an acceptable risk and return. If we legislate a five-mile-an-hour speed limit, 41,000 people would live next year. However, the lifestyle that we enjoy would be severely changed.

You can put sort of that same analogy in the flow of information. If you just totally stop it, we're going to suffer a lot. The challenge for business is to define reasonable or appropriate uses of personal information, but maybe even the bigger challenge is executing those strategies.

In fact, we're really talking about both business as well as technical challenges here. My observation in general is that industry is moving as quickly as possible to address a lot of these issues and even what I would call opportunities that are offered by the better use of information. Also, my further observation is most of these companies are acting in a very responsible manner vis-a-vis privacy. They want to do the right thing. They really don't want to invade people's privacy.

But my big concern right now is that legislation or regulation is potentially actually going to get in the way of all this happening. And, obviously, it's going to impact the potential success of companies, as laws are passed that restrict the flow of information. What is particularly alarming to me is that the guys who are framing these issues-the lawmakers who are casting votes on Capitol Hill-are not really wired into these issues.

A few months ago I called on two congressmen and two senators, all leaders in the House and Senate. I was somewhat amazed at their low level of understanding of these issues. And I was very gratified with the fact that they were asking a lot of questions. But it was the questions that were disturbing to me. And one of the other Congressmen said, "You know, I've heard this opt-in and opt-out thing, and I really don't understand it. Would you all just explain it for a few minutes?"

The thing is, these were some of the guys who were involved in the Gramm-Leach-Bliley-Law. There are some good things about the GLB Law; it does talk about notice and choice. But there are estimates that to implement that law it could cost the American financial institutions billions.

Donlon: At the privacy summit in Washington, one of the things that came out was the fact that if the U.S. signs this agreement they will actually be held to a higher standard than the European companies.

Gary Clayton: (Privacy Council): But in fairness, let me defend the Europeans for a second.

Morgan: Don't you dare. [Laughter]

Clayton: I would say that you are right in a general statement, that there is a difference between the way they sort of enforce it and the way we enforce it. Lawyers enforce it here with actions, and the Europeans don't have that same model--yet. But they're getting there. But you can't enforce these laws across an entire economy without a buy-in of business, without a buy-in of media, and consumers, and everyone else.

Morgan: I want to make it clear, I do support some basic legislation. I have worked diligently with some other people to get the Direct Marketing Association to change their position. We are going to come out with a policy to support targeted legislation.

Donlon: The question is, what is really going to be driving this? The laws, the politicians, or what your customers are saying? And not just what they're saying, but how they actually are doing it, practicing this.

Agnes Bundy Scanlan (FleetBoston Financial): We've just done some focus groups in Boston, New York, and San Francisco testing on sharing information with customers and non-customers. When you talk about privacy with customers, they don't really, unless you bring up the topic, spill the beans. They will just say, "Oh, I'm really concerned about my information being shared. I didn't know that your credit card company shared information with your mortgage company."

They do believe that financial institutions, in general, protect their information. They're very much concerned about the flow of information on the Internet. They're concerned about giving their Social Security numbers. They're concerned about when they have to give identification over the phone.

Arnie Pollard (CE): What are the key elements of that law that's coming at us, and how does that all compare to what the European governing rules are?

Clayton: The Europeans view it differently. One of the reasons is that privacy is considered a fundamental given right. So it's a political issue that the government enforces, like the right of free speech or the right to vote. It's nor just a consumer-driven rule. And their rules are designed to guard against personal information being used against citizens for abusive things. They've passed laws that are designed to implement certain fundamental rights--notice, choice, access, security. They've proposed a couple of others. One is transferability. Can you transfer it outside of the EU?

And then, more importantly from my perspective, I think what people are struggling with in the U.S. is the right of redress. If you don't use information like you say you will, what do we do? Do I have to sue you?

We had privacy laws and litigation that's gone on in the U.S. for a long time. But what we've done in the U.S. is focus on this almost as though it is simply a business issue. We have legislation on certain specific sectors of the economy, such as financial. But if you look at all of those, when it comes down to it, there are about six principles that underlie almost all of these. We don't necessarily agree with the rest of the world on the government's role in that. What has to happen over the world economy is we've got to reach sort of an agreement, a consensus on the rules of the road.

There will not be one set of rules for privacy--there will be multiple rules, That's the challenge--how do you take these different perspectives, different cultural views, different historical views, and make them jibe so that we can all work and function?

James Van Houten: (Mutual Service Insurance Companies): Why?

Clayton: Why do we have to do that?

Van Houten: Yeah.

Clayton: Because you have a global economy...

Van Houten: But each of those countries is big enough that it can support a certain market by itself. In fact, that's the historical model. That's why statutes end at national boundaries. Why isn't France a big enough market for somebody to market a little bit differently than they do in Germany? That's the way we do it now. Why in the world would we want to copy what's going on in Europe?

I think your argument's interesting. But I think that's the most bizarre description of how we ought to scope our policy that I've heard.

Clayton: I was really trying to lay a perspective. But your answer is that not all of us are simply involved in marketing, not all of us are involved simply in sales or use of information. So those companies that have global interest and global access to data, that want to share the benefits of a global economy, are facing a dilemma: How do you use data if countries--and there are 30-plus--will not allow you to export data unless you have certain guarantees of privacy in your home country?

Van Houten: But what do you do then? Do you market everywhere in the world based on the place with the most restrictive regulations than anywhere in the world? That's nuts! What you do is you market everywhere in the world based upon the most liberal you can be within the environment that exists, and scale down where the local statutes require you to behave that way. You don't use the most restrictive statutes.

Scanlan: We're in this predicament where what we find from a privacy perspective is that we need to have one law for the U.S. and one for international. There are customs in many countries about how to mail and not to mail. In South America they do not trust the mail, so how do we communicate with those individuals? I would say that at least the people at Fleet, who do a lot of business in South America, believe that the laws of secrecy in South America are much more stringent than the U.S.

Van Houten: Well, you don't want to use those laws in the U.S. then?

Scanlan: No, no.

Van Houten: Well, I rest my case.

Scanlan: Not necessarily, but we need to balance what we're doing in the U.S., because we have customers...

Van Houten: Why do you care about a South [American] law when you market in Boston or Philadelphia?

Scanlan: Because our company does business in the U.S., and some of the customers have accounts in the U.S. as well as in South America.

Van Houten: But each of those are under a different contract. You don't have a lease contract in Boston that covers a privacy law in South America, do you?

Scanlan: No, but we need to have a communication that is clear and conspicuous to them. They need to understand what we're doing and how we do business. So we can't just have segmentations from different countries; we really have to have something that's more of a global base, because we do business throughout the world.

Van Houten: So your argument is that we should have one law internationally and use the most stringent provisions, or that we should not? I don't understand what you're saying, Agnes.

Scanlan: What I'm saying is that in the U.S. for Fleet, from a privacy perspective, we're going to have a national privacy policy, and we're going to have an international privacy policy that we hope will encompass what happens on the international front. I'm not saying it's going to be stricter or not stricter, but we need to balance the two.

David Langstaff (Veridian): I'm not sure there's any solution, but I think that it's in the interest of American business to find common ground around the world where it practices its business. I think that, Agnes, your story--when you mention [privacy], it's a hot button--suggests that there's an expectation on the part of the public that it's going to be taken care of.

And what we're dealing with in business is the fact that technology has created a big gap, and there's a big gap between what can be done and what is done in practice, and what the expectations of the population are. What is at stake for business is if you cross over, you are exposing your brand, and you are losing trust.

I think there are two things that are inevitable: Technology will give us the tools to make privacy barriers very weak. We've never failed to penetrate a security network. They're not secure. You can't slow down technology, so how we use it is going to be the issue. The other thing that will happen is regulation.

And so I think this is a challenge to corporate responsibility, if you will, to kind of play a proactive role to find a shared solution here, both domestically as well as how we do business around the world.

Donlon: Jim, do you agree, or disagree with that?

Van Houten: I guess I don't. I just would say that a couple of good points have been made. We did some research and what we found was that privacy wasn't even on the list. But when we gave them a list of things which included privacy, 8 percent of the people named it in the top three.

It's the kind of thing you can stimulate and have the public react to. But the public right now is really not concerned. Only 16 percent of the public say they think they've had an experience where their privacy has been misused. It's waiting there for the politicians to stir up.

Donlon: How do we get ahead of the curve?

Dean Ross Eaker (ThinkDirectMarketing.com): Education, especially from the direct marketing point of view. You know, the whole opt in, opt out privacy policies, which require Internet companies to obtain people's permission. These are issues that are affecting the direct marketing industry, in general, which I believe has an effect on the overall issue on consumers in general.

The other issue that's at stake here is the fact that when a lot of these dotcom companies go under, who owns the rights to the data files? And whoever acquires those companies, do they have the right to acquire the assets?

Klaus Dorfi (Atlantic Mutual Insurance Co.): In terms of the question you ask, do we as businessmen advacate no laws, or same laws? I think clearly we've got to take the offensive, because others are going to define the playing field for us according to their special interest. I think we make bald statements as to what we stand for, and how sensitive we are to the issue, and try to shape public policy in a direction that allows us to conduct our business. I'm all far less regulation, but I was a victim of a fraud involving credit card, and as a consumer I want big protection.

Donlon: If we took Charles' four paints--notice, choice, access, security--and Gary's two extra--transferability and redress--and somehow turned those into legislation--would that be a way of getting ahead of the curve?

Dorfi: The politicians are really lagging, and they're often faced with the need to pass laws. And now they're becoming increasingly sensitive to the issues. The states, for example, which regulate insurance, want to outdo the federal government and pass mare onerous laws than Gramm-Leach-Bliley.

Donlon: How do you educate? You just past privacy policies?

Eaker: No one reads those.

Scanlan: We're grappling with that right now. But you have to talk with customers when they come into the branch, when they want to sign up for a new application. We have a lot of training to do internally, so that we can educate our customers.

Marcy Syms (Syms Corp.): In face-to-face encounters we don't ask far anything more than a zip code. And, really, people are almost robots today. They just hand over their credit cards and their zip codes simultaneously, because they're conditioned to give that information. Online, people have different sensibilities. I've found that they're much more sensitive, actually, about giving information online, because they don't know where it's going. You can get a lot more eyeball to eyeball.

Clayton: That explains one of the things that people have to understand. Technology's changing, but people don't. We feel uncomfortable with new technologies. We don't feel uncomfortable walking into a room where everyone looks alike or everyone talks alike, and we have some sort of rules that we understand.

And businesses make the mistake of just pretending people don't understand the issue. What starts happening, particularly online, is shopping carts get dropped. At a lot of the dot-cam companies, when they get to where people are signing up, 60 to 65 percent are dropping. Marcy said if she had 65 percent go up to pay and walk away, she'd be out of business.

You also get the other phenomenon of people just lying with the information. They provide only enough so that they can complete a transaction. And therefore it undermines the very relationship that all of you want to build. Privacy is not just putting a policy up--that's the worst thing you can do if you don't understand how you use data.

So you have a complexity level that exceeds what you get even in the insurance industry or medical, where you have 50 different state laws. Unfortunately, Congress is nor going to preempt the states right now. The Congressional Privacy Delegation caucus has made it very clear they're going to set a basic minimum perhaps, but they're not going to set a ceiling.

Leigh Abrams (Drew Industries): I know if I was sitting in a group of manufacturing executives, we would have a representative here from the National Association of Manufacturers. They would poll our constituencies and come up with a policy, which they would present to Washington.

I hear here a whole bunch of different groups--banking, insurance, dotcoms--and I don't know if there's any central organization that's going to approach Washington to tell you what policy everybody wants. And accordingly there's going to be no policy.

Morgan: Well, the Direct Marketing Association did commission a study, and the recommendation was stunning to me, telling the industry group responsible that you guys have got to go out proactively and support a legislative agenda.

Jennifer Barrett (Acxiom): I think it's fair to say that we certainly believe that a combination of legislation coupled with very aggressive self-regulation is what it's going to take to solve this problem. We've got to get ahead of the legislators because they don't understand the problem.

But I think fundamentally, as business people what we've got to understand is right now we are dealing with a consumer population that has a wide variety of interests. You know, you can quote all the surveys you want. If you try to net them down they tell us two things. The first is that we have somewhere between 5 percent and 15 percent of the population that wants absolute anonymity. Second, somewhere between 5 percent and 15 percent of the population that will tell you anything on television, in any place, in any forum, they don't care at all about it. So, what we have is somewhere between 70 and 90 percent of the population that falls in the middle, and that population sways with what goes on in the media. They get more concerned when we have horror stories, when we have court cases being brought. And then when it fades from the public view, it falls below the radar screen.

Donlon: So there's a hair-trigger response.

Barrett: What we have to accept as business people is that we all have customers, and I always argue the principle that this is not a consumer issue. This is an issue for all of us, whether we're dealing with consumers, or professionals, or bigger corporations. Because how we feel about this issue in our personal lives also spills over to our professional lives. So we've got this blending of personal and professional attitudes about privacy, but it is fundamentally an attitude of fear.

Consumers feel like they're losing control, they feel like they're being taken advantage of. And that's the fundamental emotional driver that make them opt out, or that make them go to their Congressman and complain. We've got to conduct our business in a way that takes the fear out of it. Technology is creating part of the problem, but technology can also help solve part of the problem.

And we've got to be responsible in getting very involved with our legislators in making them aware, through personal relationships with those who are in your districts, to really make them understand that legislation on a broad basis is not going to solve the problem. Because what works for financial services--i.e. the Gramm-Leach-Bliley bill--will not work in retail.

Thomas Mastrelli (VNU): Actually, I agree with what everyone is saying. But I think actually what we're going to have to think about is technology--basically you're looking at a buy-and-sell side, if you think about it. As part and parcel of all these privacy issues, sooner or later there's going to have to be changes in some of our business models.

Consumers may find that they have value to sell--which is their information about what they do.

Van Houten: Everybody thinks there's going to be some regulation, but the devil's in the derails. I don't think we're worried about a law; we're worried about a law that's damaging, aren't we?

If you look at Gramm-Leach-Bliley or the Financial Services Modernization Act, basically what happened is that Congress was unable to reach agreement. That meant it was turned over to the federal government. Which meant the consumer had to proactively sign up and say, yep, you can use my name for that specific purpose. That was catastrophic.

It certainly sounds like whatever regulations we make right now ought to be biased toward liberality, you know, with it being easier to tighten them up later than relax them later. And maybe even with a sunset provision, so it's got to be passed all over again.

Allan Rappaport (National Emergency Services): In healthcare, regulation's here, HIPA stands for the Health Insurance Portability and Accountability Act. Among the myriad provisions is a right to privacy that's very clearly defined. But there is going to be an absolute prohibition against sharing of medical records, except for very clearly defined purposes. And if there's a breach of that confidence, there are civil and criminal penalties that will be imposed. This goes far beyond, I think, anything that anybody in this room imagines in other fields.

Donlon: That means that you as the CEO have personal liability?

Rappaport: I don't know if I personally will have liability. But I think that if there's evidence that I in any way willfully encourage the release of confidential information, yes, I would have criminal liability if there was any intention to willfully violate the law.

Van Houten: HIPA is a good example--the regulations as written now would nor let a clinic notify women, for example, who are due for a mammogram because it's been two years. That would be impossible, because it's unrelated directly to the practice of medicine. You could not remind old people to get flu shots because you're using age-related data by someone other than a practicing physician.

Chris Darby (@Stake): Well, it's an interesting discussion, to the extent that there seems to be a premise that policy and law can create privacy. I don't want to be an alarmist from the technology point of view, but you don't have a prayer. [Laughter]

Donlon: Thanks for that encouragement.

Darby: I tend to agree with David's premise, and that is that you either own your own data or your data's going to own you, one way or another. Now, I think there are security things that enterprises can do. At the rate of technical evolution that we're currently experiencing, you can't create privacy. Organizations can deploy tools, fully explain the cookie propositions, and keep current in what security technologies are available to you as a corporation.

Syms: It gets down to understanding the trust factor. Each consumer is a commodity, and has something to sell. If business pays you for the information, that might be a way to crack away at some of the distrust. If you want to use this information about my buying habit for shoes, let's say, I get $20 off any purchase.

Arnie Pollard (CE): But you'd like to be paid in shoes--we heard you loud and clear.

Syms: Yeah, some effort has to be made that this is not just a movement of greed. I think the backlash factor is a real factor.

Morgan: One study result that I've seen is, the longer somebody's been an Internet user, and the more they've done on the Internet, generally the lower their fear is. So that does tell us that over a long period of time we re going to see a change in attitude as everybody gets more wired and does more transactional stuff. But even those who have been significant long term users still have fears and concerns. We've got a number of laws and what I'm concerned about is the insidious chipping away, and the insidious complexity that it's adding to our business. To have all these different ways to do business will make doing business more expensive, less efficient. The consumer's the one that's going to suffer in the end.

Pollard: Charles, by what principle would you draw the line, between what ought to be kept private and what ought to be available for good business decision purposes?

Langstaff: Wait, before you can draw the line it seems that the answer first has to start with who owns the data. Because if it's mine as a consumer, then I can enter into a business relationship with you where I let you have this, but for these purposes. And this is where technology is part of the solution. Then either you own what I let you have, or you're borrowing it and you don't own it. But there's a business deal there.

Darby: He's right. Because, you know, really, we're talking an awful lot about policy, but we're not talking a lot about hard investment. The problem I have is that companies are talking a lot about policy and law, but they're not backing it up with investment in this space.

Clayton: Ownership sounds like the issue, but the issue is really contractual obligation. I think you said it, Marcy, its trust.

The businesses we work with, particularly on the Internet, where we have implemented a whole series of measures, show more consumers giving information, they show shopping cart rates where people were dropping before, have declined. One company had 17 percent more people completing the transactions. And they hadn't done anything but change their business philosophy. Which tells me people want you to do what's right...

Dorfi: I'd like to defend business here. Business is very capable of adapting to the environment once it understands it. But government has really been a problem to a large extent.

Barrett: I want to add a little element of complexity, unfortunately, to this issue. Think about credit reports. Now, if people with bad credit could opt out of having their financial institutions provide their information to the credit bureau, which is then used for a further decision of credit, we'd all suffer.

So we have maybe a broader category of what I call societal benefits that come from fairly broad-based information sharing. I agree with what you're saying in terms of letting the consumers feet in control--we've got to give them an element of control--but there are exceptions where this data can be used for certain acknowledged beneficial purposes.

We've got to protect those, because in the rush to legislation we may have hurt more than we've saved. You can only go so far with the concepts of you own it and you control it.

Managing the Risks

Clayton: The risk industry is actually working with companies that are developing policies that will cover businesses. And I'll tell you what's coming next is policies that will cover consumers and employees. They don't buy it, but the businesses buy it, and it's almost like a bond.

So the answer is, it may not be covered under your existing policies, but industry is developing a risk management model, particularly for international business and multinationals, that will cover data flows. They started off with a logical assumption that, gee, it's very easy to understand that if the network breaks or someone hacks in, we have damage.

Darby: What they don't realize is how easy it is to break in. There are a lot of senior executives walking around thinking they've got firewalls, therefore they've got security. I'm sure David would agree that firewalls are at best these days a speed bump in and out of your corporation. [Laughter]

Donlon: What's the most important thing you think you can do to put the ball forward? To advance and get ahead of the curve, to protect your company, to get ahead of this issue so that you will not be swallowed up by it?

Langstaff: Okay. First of all, I think there's an opportunity for business, for me as a CEO to be proactive in trying to develop a solution. It's getting involved--policy level in this discussion. Do what we can to help educate those that are going to be writing the laws and such. You know, it comes back to values of a company and the kind of employees you have, and the kind of education you do with your own employees, reinforce the values of the company to the point that we trust our employees.

Eaker: From our perspective, especially catering to small and medium businesses, it's a grassroots effort. We're going to utilize our direct mail capabilities to allow them to learn a little bit more if they want to opt in. It's our position to make sure that they're aware of it.

Rappaport: HIPA is here now-- there's a two- to three-year period to comply. But because many of the medical companies I'll be competing with are offshore, they probably will ignore that provision. So my responsibility as CEO is going to be to aggressively comply with the law, to educate consumers so that they feel safe coming to our sire, putting their medical records on site and getting treated.

Darby: Start with values, move to education in technology, process, and policy, and then on an ongoing basis understand that this is a dynamic issue, not a static issue. It's got to become an organic part of your company.

Abrams: We don't deal with consumers, but we do deal with employees, and our policy with employees has always been private information is private, and we'll just continue to do the right thing as far as they're concerned.

Barrett: Corporate values based on sound policies that you follow are all aimed at developing and moving the trust bar up. Secondly, to engage with the industry to promote aggressive self-regulation, and then, thirdly, to work with legislators so that we impact positively whatever legislation is passed.

Dorfi: What we can do as business leaders is to get the organization to do the "right thing," in terms of consumer privacy now. And then proactively promote that to our respective regulators. Responsible companies are doing that, and public policy should not prevent us from continuing our respective businesses.

Syms: I think recognizing the value of a customer, and sharing that value with the customer. On our Web site if you choose to give us information, you are able to print out a $10 coupon, which you could use on your next purchase. If you don't choose to give the information, you don't get the $10 coupon.

Van Houten: There are still so many issues that are unresolved, that our No. 1 objective ought to be to make sure that no laws are passed without a broad public debate. And we ought to fight to the death if we have to, to minimize legislation at the state or the federal level until everybody stands up and has open hearings, and we're sure that everybody really understands.

Carol Evans (CE): What I see with this privacy issue is that this could become much, much bigger publicly, incredibly quickly. And where I think it's going to hit is on the level of parents, especially mothers, getting freaked out about privacy issues regarding their children.

Scanlan: Customer trust is key, and what we need to do in the financial services world is ensure that we are educating our customers. We're providing them with awareness of what we're doing on privacy. We also need to ensure that we have top-of-the-line security measures to protect their information.

Mastrelli: Just some key words: Productivity, continued priority of the issue, continued education, continued flexibility, continued trust. I think we have to continue to be vigilant and proactive to educate our legislators about the benefits of what all this means.

Clayton: Get involved, get your company involved, and show what you believe, whatever it is, whatever your position is. But take a position. Secondly, I really do think the horse is out of the barn. Industry takes the position that you've got to sir back and wait and study, and study. But if you wait, you are going to face consequences that you don't want to face. So be proactive, but in every sense of the word.

Morgan: It's interesting--we have a lot of the same themes running through here. The concepts of being more proactive, and the concepts of, you know, we have to establish trust with the consumers, with our customers.

The last thing I want to say is this whole thing of privacy is really a state of mind. That's what we talk about at Acxiom. It really is a state of the mind, [INCOMPLETE]

BELOW: Participants at the roundtable held in partnership with Acxiom at The Carlyle Hotel in New York City.

Who's WHO 

* Leigh J. Abrams is president and chief executive of White Plains, NY-based Drew Industries, a $330 million manufacturer of aluminum/vinyl windows and doors.

* Jennifer Barrett is company privacy officer of Little Rock, AR-based Acxiom Corp., a $998 million provider of computer-based customer data integration services.

* Gary E. Clayton is founder and chief executive of Dallas, TX-based Privacy Council, a provider of privacy technology and services.

* Chris Darby is president and chief executive of Cambridge, MA-based @Stake, a provider of Internet security services.

* Klaus G. Dorfi is chairman and chief executive of New York, NY-based Atlantic Mutual Insurance CO., a provider of property and casualty insurance with gross premiums written of $786.2 million.

* Dean Ross Eaker is president and chief executive of Stamford, CT-based ThinkDirectMarketing.com, a provider of online products and services for direct marketing processes.

* David H. Langstaff is president and chief executive of Alexandria, VA-based Veridian, a provider and developer of intelligent IT solutions with more than $650 million in revenues.

* Thomas A. Mastrelli is chief operating officer of New York, NY-based VNU, the U.S. holding company for VNU's U.S.-based and/or managed business media and information properties with $900 million in revenues.

* Charles D. Morgan is company leader of Little Rock, AR-based Acxiom, a $998 million provider of computer-based customer data integration services.

* Allan H. Rappaport is chairman and chief executive of Tiburon, CA-based National Emergency Services (NES), a provider of medical staffing services with more than $100 million in revenues.

* Agnes Bundy Scanlan is chief privacy officer of Boston, MA-based FleetBoston Financial Corp., a banking and financial services firm with $190 billion in assets.

* Marcy Syms is president and chief executive of Secaucus, NJ-based Syms Corp., a $350 million off-price apparel retailer.

* James F. Van Houten is president and chief executive of Arden Hills, MN-based Mutual Service Insurance Cos., a provider of insurance and financial services with assets under management of $1.7 billion.

the next BIG ONE, maybe

Michael W. LYNCH

The issue of data privacy has arrived on the banks of the Potomac River and American CEOs better put it near the top of their "To Do," lists. That, at least, was the consensus of the 375 Internet activists, international politicians and bureaucrats, political operatives, and representatives from corporate America who convened at a Privacy Summit in Washington, D.C., in mid-September. "No matter what business you're in, you're handling personal information of employees, if not customers," said Evan Hendricks, editor and publisher of Privacy Times. "There's no escaping privacy."

There was certainly no escape from the issue on Capitol Hill. More than 250 bills touching on privacy were introduced in the 106th Congress and hundreds more were introduced in state legislatures across America. Congress has passed targeted privacy legislation, the Children's Online Privacy Act in 1998 and the Gramm-Leach-Bliley Act in 1999, the financial modernization bill that had a privacy component. Even absent a federal privacy law, the Federal Trade Commission issued general privacy principles and stepped up its enforcement in the area, punishing companies that fail to live up to posted privacy policies.

The issue has even emerged in the presidential race. Governor George W. Bush's campaign says he won't rule out more restrictive privacy laws. Vice President Al Gore has promised them. "You have a fundamental right to privacy and no powerful interests should be able to sell it or take it away," Gore told an L.A. audience September 19th.

What to expect

In the early 19905, privacy issues generally centered on fears of government invasion of privacy, notes Wired.com Washington correspondent Declan McCullagh. There were contentious debates over the clipper chip, online wire tapping, and encryption. Today, the focus has shifted to private use of data, prompted by the European Union's 1998 Data Protection Directive that threatened to deny access to the European Market to companies that didn't comply with strict privacy guidelines. The advent of e-commerce gave rise to further concern, with consumers asked to give information ranging from their credit card numbers to the number of pets they own to the goods they've purchased online. Sometimes business leaders didn't help, uttering statements like Sun Microsystems CEO Scott McNealy's now-infamous, "You already have zero privacy--get over it," said at a product launch in January 1999.

In one sense, the emerging battle is a clash of cultures: Online vs. offline. European vs. American. Off-line companies have long been collecting, analyzing, and selling consumer data, from magazine subscription lists to credit reports, without much complaint. The results? Unsolicited mail, catalogs, and telephone sales--but also easy credit, customized marketing, and cheaper products. Such collection and marketing tactics didn't settle well with the hypersensitive Web culture, whose denizens were already highly suspect of the commercialization of their playground.

And then there's the international aspect. Freedom of speech is a fundamental American value, one that our laws and practices reflect. Personal privacy is a fundamental European value. The two views are incompatible. Data are almost always generated in a two-party transaction. The U.S. default is that either party can make use of the information, unless prohibited from doing so by a specific law. The European default--and increasingly the rest of the Western world's--is that the consumer owns the information and has an enforceable right that it not be used.

The EU directive, and laws in Canada, Hong Kong, New Zealand, and one pending in Australia are all based on a set of Fair Information Practices and OECD privacy principles. In brief, the principles include individual knowledge that data is being collected, the individual right to inspect and correct inaccurate data, that use of data be limited to the purpose for which it was collected, and that it's kept secure.

These principles are embedded in regulatory regimes that can be considered either "opt-In" or "opt-out." With a few exceptions, the U.S. operates on an opt-out model. Magazine publishers don't have to ask permission before they sell your name and address to direct marketers. Privacy advocates, however, are pushing for an opt-in world, based on the European model, in which consumers have to give active consent before their information is used.

No one thinks we'll get there in the next couple of years, but it's clearly where we are headed, especially for sensitive financial and medical information. The Gramm-Leach-Bliley Act, which modernized banking, requires financial institutions to contact customers annually to get consent to use their information. The Department of Health and Human Services is currently finalizing regulations restricting companies' use of patients' medical information.

The result is a mess of rules that few people can figure out and no one can enforce. A General Accounting Office study of government Web sites found that only 3 percent lived up to the four standards for privacy set by the FTC. Even the FTC, the bureaucracy that's likely to ding corporate America, failed.

Some rules are contradictory. Intuits' Director of Privacy David Merenbach points out that the Gramm-Leach-Bliley law requires his company to contact its customers by mail once a year. The problem: Intuit, respecting their customers' privacy, doesn't collect their snail mail addresses. Says Merenbach, "We have to e-mail our customer base, over 500,000 people, saying we'd like to communicate with you electronically to provide you notice of our privacy policies."

The biggest potential commerce clog between EU countries and the U.S. was dispersed this summer when the Commerce Department developed a "Safe Harbor" agreement with the European Commission, under which U.S. companies register with the Commerce Department as agreeing to abide by the European Data Directive. Privacy activists grouse that this means that Europeans will have more rights than U.S. citizens in their dealings with U.S-based companies. They will push this "fairness" argument to ratchet U.S. laws up to the EU level.

But Ambassador David L. Aaron, who negotiated the agreement for the Commerce Department, pointed out another potential inequality at the Privacy Summit. Europe has a restrictive law, but neither an army of bureaucratic enforcers nor packs of voracious trial lawyers. Therefore, the rules might be restrictive, but the enforcement may prove to be lax. Not so in the U.S., where activists and lawyers will be eager to sue for the first violation of safe harbor. Ironically, it's U.S.-based companies that might actually be held to the higher standard. (In fact, the Yanks are already meeting a higher standard, according to a survey of European and U.S. government and commercial Web sites by ClickSure, a new British company specializing in online privacy. Based on a survey of 500 sites, ClickSure found that U.S. government sites were 43 percent better than European sites and U.S. commercial sites rated 2 percent better.)

So what's a CEO to do?

Not surprisingly, the universal advice conference participants have for American CEOs is to hire people like them to be Chief Privacy Officers (CPOs), who report directly to the CEO. It's straight out of political economy 101. The people who foment the problem propose to get paid off for creating the solution, either by staffing the increasing government enforcement positions or the compliance positions in the private sector.

The best advice might be gleaned from a conference refrain: that consumers are demanding privacy and those companies who provide it will prosper in the new economy, and those who don't, won't. Chanters of this mantra point to consumer surveys commissioned by interested parties that show privacy concerns and self-serving interpretation of lackluster e-commerce sales to vouch for its veracity. "It has become a perception that it's a growing problem," says Eric Gertler, CEO of Privista, a privacy tool software company that co-sponsored the summit. "It may not be true, but it's a perception and once it's a perception it's a reality."

Why take Gertler's word for it? Get in touch with your customer base and employees and see how they really feel about data privacy, and the tradeoffs, such as fewer discounts, less personalized service, less tailored marketing, that segregating each bit of it will entail. If your customers in fact require more privacy, you won't need a bureaucrat to tell you how to proceed.

Michael W. Lynch is Washington Editor of Reason magazine.