The Only ChoiceA privacy strategy is no longer just an option - it's a requirementby Matthew Ellis Continued from Page 1 Another important part of this initial step is assessing the private legislation in the company's geographical regions. The United States has more than 500 pieces of pending privacy legislation, while other regions throughout the world have more established and stringent privacy legislation and restrictions on the use of data. In Europe, for example, a substantial amount of privacy legislation has been in place for more than 10 years. Australia and Asia-Pacific regions have rigid privacy legislation that requires employers and companies to protect the information they have on individuals, and continue to hold companies responsible for the privacy and security of that information. A U.S.-based company with operations in other global regions is certainly affected by the privacy laws of those regions. U.S. law tends to focus on protecting children, as well as a person's health care and financial information. Other countries focus on these as well, but are also far more rigorous in other areas. For example, a marketing company in the United Kingdom may have to acquire customer approvals before sending a direct mail piece. Communicate, Communicate, CommunicateCommunicating an organization's privacy strategy is as important as the strategy itself - perception is reality. For example, Amazon.com recently made a mundane change to its privacy policy and some industry observers didn't believe the company adequately communicated the upcoming change. As a result, a privacy investigation was launched against the company, which in turn was quietly dropped as no privacy breach was proven. Lesson learned: The company didn't communicate the change, or if it did, consumers didn't effectively hear the message. Consumer and government perception inflated the reality, and Amazon.com paid the price in negative publicity and public perception. Branding a privacy strategy involves making it real both inside and outside an organization. This branding can only be achieved through communication, education, and a company's commitment to doing the right thing. Once the privacy strategy has been established, it must be communicated to employees, customers, and the world at large. The company must also provide adequate training for employees and customers. The policy should be posted for all to see. But keep in mind that just because a company does all this hard work doesn't mean that the world automatically understands the organization's position and commitment to privacy. A privacy strategy needs to permeate all areas of the company - from marketing and sales to R&D and engineering. When all the key players are aware and thinking about the company's privacy stance, the organization can be proactive in dealing with privacy issues. This strategy makes privacy a fundamental thought pattern of each employee and clearly and concisely communicates the overall strategy and values to all. |
Everybody in an organization is responsible for understanding the concept of privacy and implementing it in daily activities. Every employee should follow the policies and base business actions upon it. When it comes to privacy, organizations must make sure that what they say they're doing with an individual's personally identifiable information is in fact what they are doing.
After all, privacy is no longer a choice. It's an expectation and a requirement. Companies that develop and communicate their privacy strategies accordingly will reap the business rewards.
Matthew Ellis is a senior manager and the practice area leader for Ernst & Young's privacy practice based in San Francisco. He leads a team that helps businesses strategically develop global privacy strategies that grow and build consumer confidence by assessing organizational risk through designing ethically and legally sound privacy policies and procedures. Ellis is a global public speaker and international industry expert on a variety of privacy issues.
 
|
 
|
  
|
