Government intervention aside, many experts argue that carefully thought-out privacy controls make good business sense. Larry Ponemon, the founder and chairman of the Ponemon Institute, has some evidence to back up that assertion. He measured "privacy trust scores" for over 1,000 companies by asking customers to rank on a scale of one to five how much they trust the companies with which they do business. For each company, Ponemon asked consumers more than 20 questions, including how much they believe the company is committed to protecting their personal information, how accurate and trustworthy they believe the information in the company's privacy policy is, and if they believe the company would do the right thing in a case of a data breach. From the rankings, Ponemon calculated weighted privacy trust scores for each company. The higher the score, the more consumers trusted a company. Ponemon then measured the rate at which consumers responded to marketing campaigns, be it direct mail or Web advertising. The higher the privacy score, the higher the response rate to marketing campaigns-and the higher the company's revenue. Taking measurements over time, Ponemon determined that just a small 1 percent increase in a privacy trust score would translate into an increase of tens of millions of dollars in revenue.

CIOs can play a major role in boosting their companies' "privacy scores." Because customer data resides in databases, it is the CIO who is in the position to suggest certain privacy policies and spearhead programs to put them into action. CIOs who work for companies with strong track records in this area say there are a number of ways IT can be used to enhance a company's privacy reputation. These corporate pioneers make sure privacy is part of every executive discussion about new products, services or internal use of customer information. And they ask their customers how they want their personal information handled. Furthermore, while most large companies offer an opt-out feature for customers who do not want their personal information used for marketing purposes or research (although even that feature is often hidden in the fine print of privacy policies), the pioneers routinely adopt opt-in, rather than opt-out, policies. And they have found that these practices help their companies improve customer relationships, ultimately contributing to a better bottom line.

"That's the real benefit of this," says Charles Giordano, associate director of privacy marketing strategy at Bell Canada and former associate director of data governance and strategy. "Opt-in and other privacy controls force you to look at the business value rather than just accessing customer information for information's sake."

Bell Canada and other privacy pioneers also give customers access to their personal data and closely monitor which employees have access to that data. They and other experts also say privacy must be ingrained in the corporate culture, which includes nonstop education, making it a part of employee performance reviews and enforcing meaningful punishments for not adhering to privacy policies.

"Times have changed," says Alan Westin, head of Privacy & American Business. "If you are the CIO, you have to go to the boss and say, 'It isn't like the old days. Unless we spend more money and more time on data security, our customer trust and reputation can go down the toilet.'"