Privacy issues: getting noticed; Privacy has become a bottom-line business issue, and companies around the globe are seeing value in ramping up compliance efforts to enhance their marketing, brand and image.

Driven by the Internet, sophisticated marketing practices, legislation and regulation, privacy issues have taken on new prominence, both in the U.S. and internationally.

A lapse in the handling of customer or employee information could cost companies dearly, not only in dollars (in lawsuits), but also in reputations and subsequent customer loss. Yet while most U.S. companies follow the law, only about 5 percent of the largest U.S. corporations seem to demonstrate a "strategic" view of privacy, by creating a management position for the implementer of policies, the "chief privacy officer (CPO)." Growth of the role came to a screeching halt amid budget cuts following the early 2000 recession and 9/11. That may be changing.

Financial Executive Managing Editor Ellen M. Heffes spoke to Alan Westin about the nature of privacy issues impacting business. Dr. Westin is co-founder and publisher of Privacy & American Business, a publication of the Hackensack, N.J.-based Center for Social & Legal Research, for which he leads the activities, and Professor of Public Law & Government Emeritus at Columbia University.

Q While privacy has long been a business concern, it's recently take new prominence. What has sparked this greater interest for businesses?

AW: Yes, privacy has been a business concern for a decade or more, but recently three things are driving it. One is identity theft and its enormous impact: Surveys show that between 33 and 38 million persons have been victims of identity theft.

Second, a significant number of people online are upset about so-called "spyware" and [other] monitoring functions. They read about "footprints" [and that] their identities and information can be harvested and misused. So, there's a feeling that the Internet is not a safe place to be.

The third is huge new regulatory [changes] in the last five to seven years in the financial services industry with GLBA (The Gramm-Leach-Bliley Act, or The Finance Modernization Act of 1999, which replaced the Glass-Steagall Act). People now receive notices telling them what [information] is being collected, and they are given certain choices.

Now, marketing to acquire customers or get them to purchase more services is impacted by a major federal regulatory system. So, financial-services businesses must pay serious attention to privacy because of both regulations and the threat of civil litigation issues.

All of the major industries that deal with consumer relations have been impacted by privacy regulation--telecommunications, financial-services, health and medical--and if you're online in any industry, privacy is relevant. Take health, for example. Driven by privacy rules under HIPAA (The Health Insurance and Portability Accountability Act), every doctor or dentist, pharmacy or hospital handling health data-processing is now knee-deep in regulations [and responsible for] privacy notices.

These [notices] have intensified the concern about privacy, and moved it from a kind of "yes, maybe we should say something nice and tell consumers we're concerned about their privacy," into a major marketing, compliance, brand and public image issue.

Q Discuss the emergence of the "chief privacy officer" that started to take hold a few years ago. Is it growing?

AW: There are between 2,000 and 3,000 privacy officers. Sometimes, somebody gets designated as a privacy officer because the organization needs to comply with a law or regulation. Other companies have a privacy officer who is more a chief strategy person and implementer. Organizations such as IBM Corp., Hewlett-Packard Co. and American Express Co. have created a privacy officer because they see privacy as being essential to their brand, marketing and customer loyalty. The difference is at the reporting and salary levels, and the perceived role inside the organization. In those with high-paid and important figures in the management system, there's a big difference in the role.

Maybe 5 percent of the largest companies have this type of strategic privacy officer. This coincides with the management style of an organization. Does it want to be proactive in areas like social policy, environmental policy, employment policy? Or does it want to wait until its industry sets standards and follow what the industry association says to do? That's about another 25 percent.

Then there are maybe another 50 percent that wait until the law is passed, and just comply with the law. The remainder percentage has trouble even complying with the law because they are badly managed and they don't know what to do.

[On growth of the CPO role], the last three or four years has seen downsizing and cost reduction inside organizations, plus, the post-9/11 limit on people traveling. A lot of things have come together to make some organizations minimize the role of privacy officer, and growth of the significant privacy officer has been hampered by those. But times are changing, and I do anticipate an expansion of the strategic privacy officer position in the next three to five years.

Q Why do businesses need to pay attention to privacy issues?

AW: Part of it is legal reasons--compliance with laws, avoidance of litigation and regulatory oversight, earning greater customer loyalty and trust and also [because companies] are in competition with others.

Q What differences do you note between the U.S. and international approach to privacy issues?

AW: Most of the industrialized nations of the world now have data protection laws which are different than [those in] the U.S. Here, we have mostly sector legislation--one set of laws for financial services, one for health, another for telecommunications, etc.

In a majority of nations, the approach is one of comprehensive privacy legislation, which covers the entire private sector, and is administered by an enforcement agency, with independent status. In the U.S. companies can pick and choose their strategy; in other countries they really have to comply with very detailed regulatory regimes.

Q On the "do-not-call-type" lists for marketers and now for cellphones: what's your view on the appropriateness of doing it that way, what you refer to as "permission marketing?"

AW: The do-not-call laws are magnificent. Without that, there would be a continued, deep anger at business. Before the do-not-call legislation, we had reached an absolutely unacceptable relationship between business and consumers in America, not matched anywhere else in the world in terms of intrusive telemarketing.

[ILLUSTRATION OMITTED]

This was done by the Federal Trade Commission (FTC). A court decision challenged it, and within one day, Congress reversed that decision. And, it hasn't hurt business in the sense that the American economy has not dried up. Companies simply use alternative and acceptable marketing tools.

Q What trends do you see emerging in 2005 and beyond related to privacy?

AW: Both at the Congressional and the state legislative level, this is not going to be a year in which business privacy is off the agenda. At the federal level, there are proposals to control more of the use of Social Security numbers; anti-spyware legislation is going to have hearings; as is the use of radio frequency identification (RFID), to make sure it doesn't pose any privacy problem as it's rolled out in business and government.

The Homeland Security-business relationship is going to be re-examined as Congress looks into the Patriot Act and whether it should change the requirements for airlines on the verification of customers, in terms of providing data to the government on movement of suspicious persons, or in frequent traveler-type programs. So, it's not going to be a quiet year in Congress on many of these issues where businesses are sharply invested.

In addition, the state legislative scene is boiling up; in California, Michigan, Massachusetts, New York and New Jersey, major legislation is pending. One example: Pennsylvania, this year, passed something which I think more states will do. [It has] made it a criminal offense if an organization violates its own privacy policies that it has communicated to its customers. This has always been a civil liability--if you promised something and you violated it--but they've now made it a criminal offense. Also, California has required that every organization have a privacy policy which they communicate.

In addition, [there are the] regulatory agencies. The FTC continues to be very active in defining what data security business has to embrace in order to say that they give adequate protection to the personal information they collect about customers.

The Federal Communications Commission (FCC) is involved in whether there should be a directory of cellphones, and under what conditions, etc.

A second trend: All of the surveys that I've done show that each year consumers are becoming increasingly assertive. Eighty percent of respondents tell us, "Yes, I've asked a business not to sell my name and address but use it only for my relations with them." Or, "I refused to give my personal information to a business because I thought it was too personal and it wasn't really needed for what they wanted."

The business community is going to have to engage in more honest dialogues with customers--about what they're comfortable with or what they are not comfortable with--if they are going to continue to have customers sign on to do business with them. That kind of increasing "privacy service," as I call it, is going to be a major factor now and in the future.

Finally, the identity theft issue is not going away at all. Even though there's been a much better legal definition of what constitutes identity theft, and much more enforcement and prosecutions at the state and federal level, identity thieves are very clever. So, while the level of identify theft in 2005 may not be as high as it's been in 2003 and 2004, this is going to be an extremely important issue for business.

"If you make a list of things that represent 'strategies of business in
the Information Age,' addressing the privacy of data security is among
the Top 10."
Alan Westin

RELATED ARTICLE: Privacy Notices: A Global Perspective

Regulators worldwide are changing their definition of what constitutes an acceptable privacy notice. The European data protection commissioners representing the 25 European Union (EU) member states published [for financial services] a common position on harmonized multi-layered notices within the EU last December. The European notice regime includes up to three layers.

The first layer is very short; it includes only the name of the collector, primary purpose and where to go for additional information. It is used when first collecting information, and notification space is limited. The second, "food-label-like" layer, would include the collector, information collected, uses and sharing, consumer choices and how to request additional information. The common, graphic format will make this layer easy to use.

The last layer would include all required disclosures. The EU common position breaks new ground by saying that compliance isn't based on any single notice element, but rather on the total notice package. Further, the EU statement recognizes the research that was used to inform the development of food nutritional labels; that research found that notices need to be very short and focused, written in "everyday" language and presented in a common format.

This is not just a European issue. The Organization for Economic Cooperation and Development (OECD) and the Asia-Pacific Economic Community (APEC) have both placed multi-layered notices on their 2005 work plans, and there is a private-sector project in Australia to reform privacy notices. Also, U.S. financial services regulators are conducting consumer research on layered notices; and it's an issue that is especially important to the regulator of national banks, the Office of the Comptroller of the Currency (OCC).

In a speech last January, acting Comptroller of the Currency Julie Williams focused on the failure of notices of all sorts to protect consumer interests. "For free markets to work, consumers need to have the means to make informed choices," said Williams, who had special criticism for those she regulates: "[I]t does trouble me that, when presented with the prospect of lessening burdens, and saving costs by providing a streamlined, short-form privacy notice ... some in the industry seem to balk. Marketing departments get uneasy because simple and straightforward disclosures ... might mean that customers will actually understand those policies and decide to opt out! The tension here is that shorter, focused consumer disclosures can meaningfully reduce regulatory burden, but, if they are done well, they will empower consumers to make some decisions that a particular bank may not like."

However, many financial services companies participating in the Center for Information Policy Leadership (CIPL) project believe quality notices help build long-term profitable relationships.

Food-label-like privacy notices will be an international norm in two to five years. The process will begin in Europe, be adopted in the APEC region and will become part of the U.S. privacy framework.

Senior managers can embrace this change as enhancing trust in a marketplace where consumer power is increasing, or they can fight it. In the end, consumers will have the knowledge to drive markets. Consumers will chose those companies that enhance their trust, based on the value they create, the manner in which they protect information and the appropriateness of their information practices.

By Martin Abrams

Martin Abrams ([e-mail]) is Executive Director, Center for Information Policy Leadership, at Hunton & Williams LLP (www.hunton.com).