Find Out What Your Customers Want

One of the best ways to place a value on personal information is to let the customer decide the value of it. That might seem counterintuitive, but it works for E-loan, an online provider of mortgages and car and personal loans. E-loan has built its reputation on providing strict privacy policies. On its website, E-loan states it has "Lending's strictest privacy policy."

In its online home equity and car loan application forms, E-loan asks customers if they want to opt out of sending their application to an overseas third-party processor. If they opt out, E-loan sends the application to a domestic processor. Unlike many other loan companies, E-loan asks customers for permission before it shares personal information with other lenders-an opt-in policy. E-loan also allows customers access to their personal data to correct errors.

"Opt-in is where the value is," says Tess Kolczek, chief privacy officer for E-loan. "That's where you get a better return."

Ponemon recommends asking customers directly what information of theirs would be a problem if it got into the wrong hands. There are the obvious answers: Social Security numbers, credit card numbers, driver's license numbers, medication information and addresses. CIOs understand the privacy implications of releasing that kind of information. But CIOs might not view other information as sensitive, even though customers do. These could include life events such as a birth of child, anniversaries and birthdays, a job change or change in marital status. Companies may use such information to send out e-mail pitches associated with these events to promote a product or service, irritating customers or violating their own privacy policies.

The answers customers provide will give CIOs the information they need to categorize personal data as highly sensitive, somewhat sensitive or nonsensitive. Appropriate protections and policies can be developed for each category, with stricter security and privacy policies for the most sensitive and less restrictive for the not so sensitive information. "This helps build trust," Ponemon says.

Once values are established for different kinds of personal data, the CIOs we talked to had specific processes that employees were required to follow to make sure the data is not misused or accessed inappropriately. At Boston's I2B2, researchers are required to go through the patient's health-care provider to obtain a patient's consent for information that is not in the medical record, such as DNA. Researchers are not allowed to contact the patient directly. The data is then encrypted before it is sent out to researchers.

Still, once the data is released, there is no safeguard (other than fear of sanctions for violating HIPAA and the researchers' professional word) that the data will not be released to third parties, such as pharmaceutical or insurance companies. "It comes down to only giving these things to people you trust," Dr. Murphy says.

The same precautions the health industry follows can be employed in other industries. Bell Canada's Giordano developed a list of privacy questions marketing managers at the telecom company must check off when new services and products are being developed and readied for marketing. Marketing managers must provide answers to such questions as how the personal data will be collected, with whom they will share the data, how the information will be stored and for how long. Giordano and sometimes a regulatory officer at the company go over the answers, and if any answers to the questions violate privacy policies or laws, Giordano works with the managers to rework the service to make sure the privacy policy is followed.

Unlike privacy officers in American companies, Giordano has a big stick to wield. In 2001, Canada passed a strict privacy law, which sets rules for how companies can collect, use or disclose personal information. For example, data cannot be stored indefinitely and can only be stored for however long it is needed. The law also gives Canadians the right to access and request correction of personal information. Companies cannot share information among affiliated companies unless they obtain permission first from customers.

Still, Giordano says Bell Canada's marketing department was reluctant at first to discuss with company executives who oversee privacy the kind of personal information they had and how they intended to use it, fearing that they might be prohibited from continuing some marketing practices. So Giordano approached the marketing managers with the idea that he was trying to find ways to protect privacy but not necessarily say no to the use of this data. For example, Bell Canada collects customer consents for its four primary services-wireless, DSL, satellite broadcasting and wireline (a multi-channeled digital service that can service three TVs, high-speed Internet and telephony all at once). In other words, a customer gives the company permission to discuss marketing opportunities with them for any or all of these three services. An onscreen prompt reminds reps what they can and cannot discuss with customers who call in.

"The approach should be: If you give us more information, we can help you with what you are trying to do within the bounds of the law and our privacy policy," Giordano says.

There's much more companies can do to make privacy a top priority among employees. At Partners Health, the staff sees posters in the halls and elevators that remind them of the HIPAA regulation requiring them not to discuss patient data in public. E-loan's Kolczek recommends that CIOs build a strong relationship with their marketing departments to keep them informed on new privacy laws, citations and how a new marketing practice may violate the privacy policy. "It can be a love-hate relationship," she admits. "But marketing knows if something is done wrong, our relationship is at stake."

Recently, Kolczek had to convince the marketing department that installing third-party adware on E-Loan's website that could track a visitor's viewing habits was something she felt violated E-loan's promise to protect customers' privacy. Marketing agreed not to install the software, she says.