With all the information bouncing around the Internet today, consumers and companies—not to mention regulators—are becoming ever more concerned about on-line privacy. The recent controversies surrounding Double-Click and Toysmart clearly underscore the big business risks involved in treating customer information cavalierly. Recognizing those risks, some companies have appointed a high-ranking manager—a chief privacy officer—as their central authority for making privacy decisions and protecting customers’ interests. HBR’s Roberta Fusaro recently spoke with one prominent CPO—Microsoft’s director of corporate privacy Richard Purcell—about the ethics of privacy in an age of free-flowing information. Why does a company need a chief privacy officer? It’s critical to have a single place where knowledge resides about the way customer information is handled and where policies are set for collecting and using on-line and off-line data. Otherwise, you risk introducing inconsistencies that can compromise the security of your company and your customers. Typically, a chief technology officer constructs a company’s strategies for information systems. The chief privacy officer then would work closely with the CTO to create a privacy program suited to those strategies. Some companies appoint a person to oversee privacy in an ad hoc way, without the title. But giving these people clear authority is important because they have to make and implement difficult decisions that affect many parts of the company. Formalizing the role also sends the message, internally and externally, that privacy is a real priority. Given the power of new information technologies, will customers just have to get used to having less privacy? There’s never been total privacy in commerce. Companies and consumers have always exchanged information, and there’s always been an assumption that companies had to manage personal information in a responsible way. That continues today, but the flow of information has been accelerated and amplified by the spread of the Internet and other technologies. In turn, the need for trust has grown dramatically. There’s never been total privacy in commerce. Companies and consumers have always exchanged information. But as the Internet amplifies the flow of information, the need for trust has grown dramatically. It’s important to recognize that a technology is rarely good or bad in itself; it all comes down to how the technology is used. For instance, “cookies” are a great asset to companies and consumers. They facilitate shopping on the Web, and they help companies tailor information and offerings for customers. But cookies can be abused; they can track and disseminate information in ways that customers haven’t approved. The potential for abuse goes both ways. Look at technologies that allow individuals to remain anonymous. Some people want to be invisible when they’re on the Web, and there are technologies that make anonymous surfing possible. But with that anonymity comes the potential for impersonation and for illegal activities such as fraud and theft. Microsoft handles a huge amount of customer information. How did it go about developing privacy policies? We began by laying out an ethical framework, a set of fundamental values that could guide the deployment of any new technology. A big part of that job was to think carefully through the social context of our business relationships—not just how we interact with customers but how all our partners interact with customers. We insist, for example, that our Web-advertising partners post comprehensive privacy policies on their sites. We make this requirement known and ensure compliance at the RFP stage of any advertising relationship. One of the complicating factors we face is that other companies—companies we have no direct influence over—use our software to collect information. Preventing abuse in these cases is largely a matter of empowering the consumer. For example, we recently enabled our Internet Explorer browser to alert consumers whenever an unknown third party is transmitting a cookie in an attempt to gather small bits of information about them—perhaps innocently, perhaps not. Consumers then have the option to accept or refuse the cookie before anything is saved to their hard drives. They can even configure their browsers to prevent any cookies from being accepted. It is of paramount importance that consumers know who is gathering information about them—and that they be willing participants. If consumers clearly understand how and why companies are using the cookies, both sides can tailor the experience to fit users’ preferences without undermining the technologies being employed and without sacrificing privacy and security. What are the basic components of your ethical framework? There are five underlying principles. The first is notice: customers should receive full disclosure of who is collecting information about them, what is being collected, and for what purpose. The second is choice: individuals should be allowed to choose how information will be used about them, how long that information will be retained, under what circumstances that information would be transferred to other parties, and so on. The third principle is access: we have to establish transparency by enabling customers to view, and even edit, the information we have so they can make sure it’s accurate and relevant. The fourth is security: we must ensure that a customer’s data are protected from unauthorized access, distribution, loss, or corruption. And finally, there must be some sort of enforcement—some mechanism that will hold us accountable for complying with any stated policies. Third parties should be involved in maintaining that compliance. From what you’ve seen, do you think companies spend enough time thinking about privacy issues? I would like to see more progress more quickly. But we have seen a tremendous increase in the number of companies that recognize the importance of having a chief privacy officer and of posting good privacy policies. When a privacy statement is posted on a company’s Web site, that statement binds the company—as we found out when Toysmart attempted to sell its customer information after it went bankrupt, even though it had promised it would not. The FTC had the authority to bring suit against Toysmart because the company had clearly stated what its practices would and would not include. Companies ignore the privacy issue at their own peril. What do you think is the best role for government to play in the privacy debate? Robust self-regulation remains our preference at this point. As we evaluate legislation being proposed through the end of this year and into the next congressional session, we’ll be looking at how rigid it is, how much it would cost to implement, how it would work for different types of businesses, and how it would affirm and promote consumer control and industry self-regulation. But no matter what legislation is enacted, it is the responsibility of the leaders in the on-line industry to provide and implement technologies that help consumers feel safer and more comfortable on-line.
