Privacy Potholes

Putting privacy legislation into practice means learning how to sidestep legal and technical problems.

Companies working hard to comply with a bewildering array of fast-changing state, federal, international and industry-specific privacy rules are uncovering a variety of practical problems along the way.

Rising concerns over personal privacy and data-sharing practices have focused on increased liability risks relating to how personal data is handled. At the same time, the trend toward extending the enterprise is making it harder than ever for companies to keep track of and protect such data.

IT managers dealing with these privacy regulations offer their best advice for avoiding the technology and process potholes.

POTHOLE: Patchwork of Laws

The sheer number of privacy regulations and new mandates coming down the pike make privacy compliance a huge challenge, says Kirk Herath, chief privacy officer at Nationwide Mutual Insurance Co.

Some of the biggest drivers include the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act, the Sarbanes-Oxley Act and California's SB 1386 identity protection bill. On the horizon are other state and federal versions of SB 1386. Several states—most notably California—have their own privacy laws. International rules, such as those covering European Union nations and Canada, are also forcing U.S. companies to confront privacy issues.

"Over the past two years, we've had over 1,000 new privacy laws that have affected us," says Joel Tietz, chief privacy officer at AXA Financial Services LLC in New York.

SIDESTEP: Instead of trying to craft policies for every single law, it's often better to try to comply with the requirements of the most stringent laws where possible, privacy experts say. Don't shoot for meeting the minimum requirements, Tietz adds. "We took the best of what we saw in all of the various requirements," he says. The company then crafted a policy to meet those standards.

POTHOLE: Complex Requirements

Writing a standard privacy notice that encapsulates all regulatory and legal requirements can be a huge challenge, Herath says. Privacy notices, which are required in every state, spell out a company's policies for handling personal data. Several laws require companies to clearly articulate what they can or can't do with confidential information. But differing requirements make it hard to draft a standard policy, Herath says.

For instance, at least 17 states still use privacy provisions from a 1982 information practice act that requires insurance companies to use specific phrases—relating to how information might be shared for law enforcement purposes, for example—when crafting a privacy policy.

Much of the language contained in such laws is written at a college reading level. "Yet you have to economize on your language and the complexity of what you are saying" to get the notice down to a ninth-grade reading level to meet some state requirements, says Herath. For instance, "instead of talking about how we can share information for law enforcement and antifraud purposes, you boil it down to 'as required by law,' " he says. Similarly, some states require that companies include opt-in policies in their privacy statements. Opt-in policies require companies to seek and receive a user's permission to collect and use personal data.

SIDESTEP: Here again, Herath suggests making the policy as broadly applicable as possible. Start with the most stringent requirements first and draft a policy statement written for those requirements.

"It can be done, but not easily," says Herath. Drafting a solid policy can take several weeks to several months and requires input from business units as well as legal and compliance teams, says Herath, who manages 35 such notices for Columbus, Ohio-based Nationwide's business units.

POTHOLE: Far-flung Data

But it's not enough to say what you'll do. You also need to do what you say. And that means putting in place the technology and processes to monitor and ensure compliance with stated privacy policies, experts say.

"The biggest issue facing corporations with respect to privacy is establishing control over all their data," says Arshad Noor, CEO of StrongAuth Inc., a Cupertino, Calif.-based identification management firm.

This data includes not only what's on production systems and backup servers and sites, but also everything stored on distributed client systems and flowing across enterprise and partner networks, he says.

SIDESTEP: To gain control, says Noor, companies must establish a detailed inventory of all sensitive data everywhere in the corporation, review all controls relating to the use of that data and set up controls and procedures to protect the data.

"All of this will require capital expense, potentially hiring new people and buying new tools," he says.

POTHOLE: Honoring Customer Preferences

Technology advancements have made it easier for companies to use and manipulate customer data, but that also makes it imperative to monitor and ensure privacy compliance, says Tietz.

For example, because AXA's CRM systems allow it to mine customer data, the company has to be careful that the information isn't being combined or shared in a manner that doesn't gel with a customer's privacy preferences, Tietz says.

"I view technology as one of my backstops to ensure that data is not flowing in an inappropriate manner," he says.

SIDESTEP: AXA has built a database that consolidates customer information from multiple applications and production systems. Each customer record in the database has an embedded "privacy indicator" that describes in detail that customer's privacy preferences. The database is linked to every legacy application at AXA. The goal is to make sure that a customer's privacy preferences are always respected, regardless of which application is accessing the customer data, Tietz says.

"Many departments are charged with using customer information to make a profit for the company," Tietz says. "An aggressive use of such information may be beneficial to the bottom line but must always be weighted against privacy needs."

AXA, which manages more than $450 billion in assets, also uses a Web monitoring tool to ensure that the information on its Web pages and its use of cookies are compliant with the company's stated privacy policy, Tietz says.

POTHOLE: Vague Language

The lack of legal precedent and implementation guidelines poses a problem for companies trying to figure out the best way to mitigate exposure to legal risk, says Erin Kenneally, a forensic analyst at the San Diego Supercomputer Center at the University of California, San Diego.

Privacy laws such as Gramm-Leach-Bliley and SB 1386 merely specify what is expected of companies from a regulatory standpoint without explaining what they need to do from an implementation standpoint, Kenneally says.

"I see it as a combination of semantic differences between the legal and policy folks who write the laws and the techies who have to implement them. It becomes an issue of extrapolating technical solutions from abstract ideas and words," Kenneally says.

Examples of such vagueness abound. California's SB 1386 requires companies to "encrypt" data, but it doesn't specify the level of encryption required. Similarly, the law requires companies to inform customers of any "unauthorized access" to their data but doesn't define what constitutes unauthorized access.

As a result, companies may decide to "just do the very minimum and comply with the letter of the law, while in practicality [that doesn't] really provide the protection that the spirit of the law was meant to address," Kenneally says. "It is entirely conceivable that a civil or a criminal claim under SB 1386 could be raised if minimal, almost ineffectual measures are used."

SIDESTEP: The key, again, is to take the high road. The best way to demonstrate due diligence is to comply with the requirements of the most stringent law that's applicable to you, Kenneally advises.

POTHOLE: Uncontrolled Partners

Programs for monitoring the privacy habits of your vendors, business partners and supply chain companies are also needed, says Herath. It's crucial to realize that a company owning the data is responsible for it even if a security breach is associated with a partner, he says.

"As we use more third parties, vetting them and the contracts they sign becomes more important and more difficult," Herath says.

SIDESTEP: Nationwide has implemented a few third-party monitoring and compliance measures to address the problem.

All companies doing business with Nationwide have to fill in a Web-based self-assessment form that allows the insurer to quickly gauge the strength of its partners' privacy practices and sort them into separate risk categories. Depending on the sensitivity of the information being handled, Nationwide might ask a company to implement stronger privacy policies. Each company also needs to submit to regular privacy audits.

When it comes to partners that are based offshore, Nationwide has instituted "deeper due diligence and security," Herath says. This includes putting Nationwide's own security personnel at an offshore location to ensure that "people don't leave with things they are not supposed to leave with," he says.

This level of physical security is especially a concern at a time when technology has made it possible for users to store vast amounts of data as storage devices get smaller, Herath says. "A few years ago, you would need a truck to take it away. Today, all a user needs is a key fob," he says.


Companies spend more on privacy activities as their programs mature.

The Annual Cost of Privacy Programs
BASE: Average direct and indirect costs of 44 U.S.-based multinational companies with more than 1,000 employees

Source: “The Cost of Privacy Study,” IBM and Ponemon Institute LLC, Tucson, Ariz., February 2004

Special Report

Compliance Headaches

Stories in this report:


Copyright © 2004 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon