CPOs hed: dek: dek: plan on paying your CPO a reasonable salary. dek: by

If you have been following the papers or listening to the national news lately, you have heard about how worried people are about privacy. If you haven't been focusing on the issue, here are a few statistics to wake you up:

According to Forrester Research, only 6 percent of North Americans express a high level of trust in how Web sites handle their personally identifiable information (PII), and seven of eight are interested in legislation protecting Internet privacy. o In a recent Forrester survey of 1,500 people, about 72 percent said that it is an extreme violation of their privacy for businesses to collect data about them and supply it to other companies. According to a 2000 survey by Privacy and American Business, 63 percent of users have asked companies not to sell or give their names and addresses to other companies. In the same survey, 87 percent of users said they refuse to provide information because they think it is not really needed and is too personal.

Privacy concerns expressed by these high percentages have already moved into the courtroom. People are suing to keep their personal information private and confidential, and they are winning. U.S. Bancorp was recently ordered to pay $7.5 million in a privacy lawsuit, and dozens of other suits are waiting for their day in court. Legal experts expect that number to swell dramatically over the coming decade as people vigorously pursue their rights to privacy.

The federal government has already jumped into the fight to help protect citizens' privacy. In 1999 Congress passed the Gramm-Leach-Bliley Act, which requires financial institutions to disclose their privacy policies to new customers, and to provide current customers with the same information at least annually. Companies must comply by July 1. Health care providers and pharmacies also face government orders to restrict access to information about their customers. Privacy is not an issue the government is going to leave alone.

A CPO? maybe

To help them stay ahead of the privacy protection curve, about a hundred companies (mainly ISPs, but also some of the Fortune 500), have hired a chief privacy officer, or CPO. It's the CPO's job to take whatever action is needed to keep the company out of legal and public relations hot water by helping it keep its data right where it should be at all times.

With many companies cutting jobs and worried about sagging revenues, the idea of adding a high-level, highly paid position to the corporate hierarchy isn't an easy idea to swallow. But it might just be the right medicine at the right time. "I believe most companies would benefit from having a CPO or a privacy office," says Keith Patrick Enright, CPO for Lucira Technologies Inc. "Privacy is something that should be on everyone's radar."

Ray Everett Church, reputedly the nation's first CPO and founder of PrivacyClue, a privacy-oriented consulting firm, says that using PII appropriately is crucial for any company. "The risk of having personally identifiable information about people is much greater than it has ever been from both a security and legal-breach aspect," he says. "Whether or not a company needs a CPO depends on how heavily the company depends upon the PII the company has and uses."

Gathering, storing, and using PII is the crux of the corporate privacy dilemma. Every corporation has the ability to record information about its customers' buying habits and correlate that information with individual names. That's great if you want to personalize mailings or develop special marketing programs. But the urge to engage in one-to-one marketing can leave a company at risk.

It is rapidly becoming every company's legal responsibility to safeguard its PII or face legal consequences. Companies don't really own the data they collect outright--it's more that the customer grants the company limited rights to use the data, all the while retaining final ownership. That's what the Federal Trade Commission (FTC) argued last year when it prevented Toysmart.com, the failed e-tailer, from selling its customer database to the highest bidder. Amazon.com also ran into trouble with the FTC when it changed its privacy policy to make it easier for other companies to make use of its PII.

Church points out that companies can also lose public-relations points by playing fast and loose with PII, even if what the company is doing is technically legal. On the other hand, a carefully crafted and executed privacy policy can actually help the company. "You can turn the privacy issue into a competitive advantage if you make your customers feel you are concerned about them," he says.

The additional PR points can improve customer loyalty and boost revenues, thereby offsetting the cost of adding a CPO and privacy team. All in all, Church says, privacy "is not something you should fear, it's something you should embrace."

CPO job description

Job one for a new CPO should be assessing the company's existing policies for safeguarding, using, and sharing data. Then the CPO can develop a new privacy policy, or revamp an existing one, to bring it into line with current legal guidelines and requirements.

Once a new policy is in place, the CPO is often responsible for making sure the policy is carried out, even if he or she isn't directly responsible for enforcing the policy. The CPO continues to monitor the privacy landscape, keeping a close eye on legal and public-relations issues and changing the policy when the need arises.

A CPO's job description may also include keeping company data, including PII, secure from evil forces outside (and within) the company. If so, the CPO participates in developing an internal security policy designed to, for instance, keep the data in a maximum-security area of the network, behind a firewall, or not accessible via a network at all.

A good CPO is part technician, part lawyer, part negotiator, and part public-relations expert. So it's not surprising that, with all these various aspects to the role, finding the right person can be difficult. It might get even harder in the next few years. According to Privacy and American Business, a privacy advocacy organization that is part of the Center for Social & Legal Research, as many as a thousand businesses will look for a CPO in 2002.

One way to recruit a CPO is to train someone already on staff (such as a member of the legal department) for the role. The Association of Corporate Privacy Officers (ACPO) and the Privacy Officers Association (POA) offer training courses, seminars, and conferences for budding CPOs. Training an appropriate person in-house gives you the benefit of handing this sensitive role to someone you already know and who knows your corporate culture and objectives.

If you decide to go outside for the new hire, you might want to contact a recruiting firm familiar with privacy-related positions. One such company is Privacy Leaders, a recruiting firm that specializes in finding corporate privacy executives. It has been in business since 1991-long before privacy became a hot business topic.

In larger companies, management may opt to break the CPO role down into smaller chunks and may even create an entire privacy department. Privacy Leaders' list of positions it can fill illustrates this division of labor. The company can help you find candidates for the posts of CPO, chief consumer affairs officer, chief public policy officer, and chief e-security officer, among others.

Whichever route you take, plan on paying your CPO whatever is reasonable and customary for executives who play key roles in your organization and report directly to the president or CEO. You may even have to pay a little more than usual if you want to hire from the outside and have your pick of top candidates.

Make sure, too, that you give the CPO the necessary clout to get things done without getting bogged down in corporate politics. Without the power to make things happen, your carefully crafted privacy policy is nothing more than a collection of nice ideas. Not only is that bad from a PR perspective, but paying lip service to your privacy promises could put your company in serious legal trouble.

CPO alternatives

If you decide that the budget will not support another high-level salary, or that your company's privacy issues don't warrant a CPO, there are other ways to get the job done. You can always take the do-it-yourself approach, hire a CPO consultant, or do a little of both.

Start by assessing your privacy policies, even if nothing is written down. Find out where data--especially PII--is kept in your company, who has access to it and what they are doing with it. Extend your search for information into all the companies you do business with; you may keep customers' data private, but your partners may not.

While you're assessing how data is collected, stored, and shared, take a good look at your real data needs. Perhaps knowing how many people bought your widgets last year and in what colors is all you need to know when it comes to planning next year's marketing campaign. If you can reduce or eliminate the need for PII, you can reduce or eliminate your potential privacy problems.

The Direct Marketing Association and the Organization for Economic Cooperation and Development have materials on their Web sites to help you evaluate your current privacy policies. These sites also offer a lot of information about privacy issues-current ones and those that may emerge in the future. More information and links to various privacy-related sites can be found on the Web sites of the two privacy trade associations, ACPO and POA.

If you're willing to pay someone to come in and talk with you about privacy or to guide you through the whole process of developing a policy, there are plenty of consulting sources available. A number of large consulting companies, including IBM, have developed or are developing privacy practices. Smaller companies such as PrivacyClue will also be happy to lend a hand.

Once you complete the assessment and have crafted a new policy, it's time to publish it. Your Web site is one obvious place to post the policy, but you might want to cover all your bases and send the policy out in writing to all your customers. Including a copy of it with your marketing materials is another way to get the word out that your company respects privacy.

Can't afford to ignore the issue

Whether you opt for a CPO or decide you can take care of your privacy needs with the staff you already have (plus a little outside help, perhaps), privacy is not an issue you can afford to ignore. This is especially true if any part of your business is e-related, because that's where privacy issues are already looming large. Lucina's Enright lays it on the line when he says, "The issue of privacy will either plague or drive the new economy. It is the core issue that determines how this all plays out."