Which are the best firms at helping organizations navigate the complexities of managing customer and employee information? That's the question I posed last month to over 2,000 people responsible for data protection. This was the third year asking this question (see "The best privacy advisers in 2007" and "The best privacy consultancies"), so we're now able to see some trend lines. I was surprised at the results.
Privacy budgets up
The most remarkable finding was that 31% of companies said they're planning to increase their 2009 budgets for outside privacy advice, despite the stock market implosion and U.S. recession that unfolded before the survey. Only 13% said they were decreasing their budgets.
Companies planning privacy budget increases, despite recession
How can data protection officers survive the budget scalpels everyone else is facing? One possible answer makes sense: Boardroom executives perhaps no longer view data privacy and security as remote risks that can be put off for a better day. If these dollars are getting sheltered or even augmented, executives must now see privacy as a bottom-line objective with immediate impact on earnings.
Call my lawyer
A second noteworthy trend is the continued dominance of the legal profession at the top of the charts. Of the 684 votes in this category, 72% were cast for law firms, including the top eight vote-getters (see Table 1).
This is surprising to me, because of the healthy debate under way in the privacy profession about where privacy should sit in the organization. The side that is prevailing in this debate argues that privacy is much bigger to corporations and to society than legal compliance. But when it comes to whose privacy opinions CPOs seek most, it continues to be those who speak with the authority of the law.
Table 2: Top Privacy Law and Consulting Firms
The top three vote-getters remain unchanged from last year’s poll, while law firms Morrison & Foerster, Kelley Drye and London-based Bird & Bird moved up a tier. In the table below, law firms are highlighted in pink, while consulting firms are highlighted in green and associations and collaboratives are highlighted in purple.
| Firm | Voting Tier* |
| HUNTON & WILLIAMS+ | I |
| VENABLE++ | II |
| BAKER & MCKENZIE++ | II |
| MORRISON & FOERSTER+ | II |
| KELLEY DRYE++ | II |
| BIRD & BIRD | II |
| FIELD FISHER WATERHOUSE | III |
| WILEY REIN++ | III |
| REBECCA HEROLD & ASSOCIATES | III |
| SAMET PRIVACY | III |
| FOLEY & LARDNER | III |
| IBM | III |
| COVINGTON & BURLING+ | III |
| DELOITTE | III |
| PRICEWATERHOUSECOOPERS | III |
| CORPORATE PRIVACY GROUP | III |
| ERNST & YOUNG | III |
| HOGAN & HARTSON+ | III |
| DLA PIPER++ | III |
| PROSKAUER ROSE+++ | III |
| SIDLEY AUSTIN++ | III |
| LINKLATERS | III |
| PONEMON INSTITUTE | III |
| PRIVACY & INFORMATION MANAGEMENT SERVICES | III |
| WILMERHALE+ | III |
| BRISTOWS | III |
| DRINKER BIDDLE & REATH | III |
| INTERNATIONAL ASSOCIATION OF PRIVACY PROFESSIONALS | III |
| VORYS, SATER, SEYMOUR & PEASE | III |
* The firms are ranked in order of the number of votes received, but banded into three tiers to compensate for statistical margin of error. To enter Tier 1, a firm needed more than 10% of the total votes, with Tier II requiring 3% to 10% and Tier III requiring 1% to 2%.
** For purposes of full disclosure, Minnesota Privacy Consultants, the author's firm, received the same number of votes as Foley & Lardner.
+ Indicates a firm that was ranked in the top Tier I of the 2008 Chambers and Partners survey of U.S. law-firm privacy and security practices. The Chambers results generally track these results.
++ Indicates a firm rated in Tier 2 by Chambers.
+++ Indicates a firm rated in Tier 3 by Chambers.