 
  See your link here
|
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Privacy Potholes
or
Other Security Stories
|
|
|
|
March 15, 2004 (Computerworld) --
Companies working hard to comply with a bewildering array of fast-changing state, federal, international and industry-specific privacy rules are uncovering a variety of practical problems along the way.
Rising concerns over personal privacy and data-sharing practices have focused on increased liability risks relating to how personal data is handled. At the same time, the trend toward extending the enterprise is making it harder than ever for companies to keep track of and protect such data.
IT managers dealing with these privacy regulations offer their best advice for avoiding the technology and process potholes.
POTHOLE: Patchwork of Laws
The sheer number of privacy regulations and new mandates coming down the pike make privacy compliance a huge challenge, says Kirk Herath, chief privacy officer at Nationwide Mutual Insurance Co.
Some of the biggest drivers include the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act, the Sarbanes-Oxley Act and California's SB 1386 identity protection bill. On the horizon are other state and federal versions of SB 1386. Several states—most notably California—have their own privacy laws. International rules, such as those covering European Union nations and Canada, are also forcing U.S. companies to confront privacy issues.
"Over the past two years, we've had over 1,000 new privacy laws that have affected us," says Joel Tietz, chief privacy officer at AXA Financial Services LLC in New York.
SIDESTEP: Instead of trying to craft policies for every single law, it's often better to try to comply with the requirements of the most stringent laws where possible, privacy experts say. Don't shoot for meeting the minimum requirements, Tietz adds. "We took the best of what we saw in all of the various requirements," he says. The company then crafted a policy to meet those standards.
POTHOLE: Complex Requirements
Writing a standard privacy notice that encapsulates all regulatory and legal requirements can be a huge challenge, Herath says. Privacy notices, which are required in every state, spell out a company's policies for handling personal data. Several laws require companies to clearly articulate what they can or can't do with confidential information. But differing requirements make it hard to draft a standard policy, Herath says.
For instance, at least 17 states still use privacy provisions from a 1982 information practice act that requires insurance companies to use specific phrases—relating to how information might be shared for law enforcement purposes, for example—when crafting a privacy policy.
Much of the language contained in such laws is written at a college reading level. "Yet you have to economize on your language and the complexity of what you are saying" to get the notice down to a ninth-grade reading level to meet some state requirements, says Herath. For instance, "instead of talking about how we can share information for law enforcement and antifraud purposes, you boil it down to 'as required by law,' " he says. Similarly, some states require that companies include opt-in policies in their privacy statements. Opt-in policies require companies to seek and receive a user's permission to collect and use personal data.
SIDESTEP: Here again, Herath suggests making the policy as broadly applicable as possible. Start with the most stringent requirements first and draft a policy statement written for those requirements.
"It can be done, but not easily," says Herath. Drafting a solid policy can take several weeks to several months and requires input from business units as well as legal and compliance teams, says Herath, who manages 35 such notices for Columbus, Ohio-based Nationwide's business units.
POTHOLE: Far-flung Data
But it's not enough to say what you'll do. You also need to do what you say. And that means putting in place the technology and processes to monitor and ensure compliance with stated privacy policies, experts say.
"The biggest issue facing corporations with respect to privacy is establishing control over all their data," says Arshad Noor, CEO of StrongAuth Inc., a Cupertino, Calif.-based identification management firm.
This data includes not only what's on production systems and backup servers and sites, but also everything stored on distributed client systems and flowing across enterprise and partner networks, he says.
SIDESTEP: To gain control, says Noor, companies must establish a detailed inventory of all sensitive data everywhere in the corporation, review all controls relating to the use of that data and set up controls and procedures to protect the data.
"All of this will require capital expense, potentially hiring new people and buying new tools," he says.
POTHOLE: Honoring Customer Preferences
Technology advancements have made it easier for companies to use and manipulate customer data, but that also makes it imperative to monitor and ensure privacy compliance, says Tietz.
For example, because AXA's CRM systems allow it to mine customer data, the company has to be careful that the information isn't being combined or shared in a manner that doesn't gel with a customer's privacy preferences, Tietz says.
"I view technology as one of my backstops to ensure that data is not flowing in an inappropriate manner," he says.
SIDESTEP: AXA has built a database that consolidates customer information from multiple applications and production systems. Each customer record in the database has an embedded "privacy indicator" that describes in detail that customer's privacy preferences. The database is linked to every legacy application at AXA. The goal is to make sure that a customer's privacy preferences are always respected, regardless of which application is accessing the customer data, Tietz says.
"Many departments are charged with using customer information to make a profit for the company," Tietz says. "An aggressive use of such information may be beneficial to the bottom line but must always be weighted against privacy needs."
AXA, which manages more than $450 billion in assets, also uses a Web monitoring tool to ensure that the information on its Web pages and its use of cookies are compliant with the company's stated privacy policy, Tietz says.
POTHOLE: Vague Language
The lack of legal precedent and implementation guidelines poses a problem for companies trying to figure out the best way to mitigate exposure to legal risk, says Erin Kenneally, a forensic analyst at the San Diego Supercomputer Center at the University of California, San Diego.
Privacy laws such as Gramm-Leach-Bliley and SB 1386 merely specify what is expected of companies from a regulatory standpoint without explaining what they need to do from an implementation standpoint, Kenneally says.
"I see it as a combination of semantic differences between the legal and policy folks who write the laws and the techies who have to implement them. It becomes an issue of extrapolating technical solutions from abstract ideas and words," Kenneally says.
Examples of such vagueness abound. California's SB 1386 requires companies to "encrypt" data, but it doesn't specify the level of encryption required. Similarly, the law requires companies to inform customers of any "unauthorized access" to their data but doesn't define what constitutes unauthorized access.
As a result, companies may decide to "just do the very minimum and comply with the letter of the law, while in practicality [that doesn't] really provide the protection that the spirit of the law was meant to address," Kenneally says. "It is entirely conceivable that a civil or a criminal claim under SB 1386 could be raised if minimal, almost ineffectual measures are used."
SIDESTEP: The key, again, is to take the high road. The best way to demonstrate due diligence is to comply with the requirements of the most stringent law that's applicable to you, Kenneally advises.
POTHOLE: Uncontrolled Partners
Programs for monitoring the privacy habits of your vendors, business partners and supply chain companies are also needed, says Herath. It's crucial to realize that a company owning the data is responsible for it even if a security breach is associated with a partner, he says.
"As we use more third parties, vetting them and the contracts they sign becomes more important and more difficult," Herath says.
SIDESTEP: Nationwide has implemented a few third-party monitoring and compliance measures to address the problem.
All companies doing business with Nationwide have to fill in a Web-based self-assessment form that allows the insurer to quickly gauge the strength of its partners' privacy practices and sort them into separate risk categories. Depending on the sensitivity of the information being handled, Nationwide might ask a company to implement stronger privacy policies. Each company also needs to submit to regular privacy audits.
When it comes to partners that are based offshore, Nationwide has instituted "deeper due diligence and security," Herath says. This includes putting Nationwide's own security personnel at an offshore location to ensure that "people don't leave with things they are not supposed to leave with," he says.
This level of physical security is especially a concern at a time when technology has made it possible for users to store vast amounts of data as storage devices get smaller, Herath says. "A few years ago, you would need a truck to take it away. Today, all a user needs is a key fob," he says.
THE ANNUAL COST OF PRIVACY PROGRAMS
Companies spend more on privacy activities as their programs mature.
BASE: Average direct and indirect costs of 44 U.S.-based multinational companies with more than 1,000 employees
Source: “The Cost of Privacy Study,” IBM and Ponemon Institute LLC, Tucson, Ariz., February 2004
- Compliance Headaches
- Privacy Potholes
- Outsourcing: Losing Control
- Chief Privacy Officers: Hot or Not?
- Privacy Glossary
- The Almanac: Privacy
- The RFID Privacy Scare is Overblown
- Test Your Privacy Knowledge
- Five Key Privacy Principles
- Privacy Payoff: Better Customer Data
- California Privacy Law a Yawner So Far
- Learn (Almost) Anything About Anybody
- Five Steps Your Company Can Take To Keep Information Private
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
|
 |
| All Zones Application Performance Zone Business Continuity Zone The File Data Management Zone Security Management Zone The SAS Zone Business Intelligence and Analytics Zone Windows Protection Zone The Enterprise Search Zone Software as a Service Zone The Security Zone |
|
See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
From Laggard to Leader: Transforming the Data Center
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. 
Download this white paper today!
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
- Feds considering changes to H-1B application process in wake of report
- The Grill: Privacy is a thing of the past, says private investigator
- Exploit code loose for six-month-old Windows bug
- More top stories
 The Security Zone
Securing your network begins at the gateway, also called the perimeter, to keep unauthorized users, viruses and malicious code from entering your systems. Deploying multilayer technologies is your first line of defense. With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. One of the key facets of a successful security strategy is protecting the servers that run critical applications and house so much of your essential data. Having the right policies, procedures and server configurations is critical. Learn more in The Security Zone See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
|
|
Preston Gralla: Apple plays the bully again
Apple is once again unleashing its attack dog lawyers. This time against a college for using an apple in its logo. ... [more]
|