Does Privacy Pay?

Computerworld - The flat economy has forced companies across America to require any new investments to deliver hard economic returns within short time frames. Do privacy-related investments generate these kinds of returns? In many cases, absolutely not. But if your company plays in a privacy-sensitive industry, your customer databases may be empty in a few years if you don't start investing in privacy now.

The reason many privacy investments—in permission-tracking technology, for example—don't generate hard returns by themselves is that they're like investing in buildings. They enable other things to happen in the future that generate the returns. In addition, there are few ways besides Web privacy seals for customers to know which companies are actually investing in and protecting privacy. If customers can't see the results of the investment, privacy won't pay.

So what does it take for privacy investments to finally generate hard returns for a company? Putting my customer hat on, privacy would have to be a key part of what I think about when I see the company's logo. I would give accurate and more complete personal information to companies I could trust. I would need to trust that the company won't share my information with others, will protect it from hackers and won't hound me with unwanted direct marketing. In America, this means going above and beyond the law.

The hard returns for such a company come in the form of more customer data that can be used to generate repeat purchases and higher average sales. This is how privacy pays.

But building the abstract experience of privacy into a brand image is no small feat. It doesn't result from a single project. It takes a long-term strategic commitment from the most senior executives and a series of projects over several years. It takes customers repeated experiences to learn that bad things aren't happening to them when they deal with your company.

So have any companies already made this strategic move? To answer this question, I reviewed the membership rosters of the Safe Harbor and privacy-seal groups, as well as other indicators of a strategic investment in data privacy. One trend became obvious: Companies that depend on collecting sensitive information or on providing the technology to manage this information—what I call "privacy-sensitive commerce"—are by far the most active in trying to make privacy pay. (To figure out if you're in privacy-sensitive commerce, see Table 1.)

The privacy steps companies take on their Web sites appear to be the clearest differentiators of who is committed to data privacy. Among the Fortune 100, 83 companies post a privacy policy, but only 15 display a privacy seal, and four have their sites enabled with the Platform for Privacy Preferences (P3P) technology. A few companies do all three.