Lydia Payne Johnson - Global Privacy Review

Welcome Message

Welcome to the world's only blog with a wholistic approach to corporate data privacy compliance, blending information technology, information security, legal, marketing and brand management into a singular resource for companies, small or large, seeking to implement or strengthen consumer privacy practices.

Lydia Payne-Johnson takes a strategic and practical approach in her consultancy practice, advising businesses globally, from the world's top corporations to small and medium-size companies.

As today's businesses face an increasingly complex set of data privacy rules and laws while managing ecommerce or online marketing efforts, Lydia provides valuable insight on the issues.

Are We Selling Out On Individual Privacy?

In today's world, common sights and sounds now include cellphone users engaged in intense - and usually loud - personal conversations.  Whether walking down the street, riding public transportation, sitting in a restaurant or, unfortunately, attempting to drive a car, public cell phone use constitutes an intrusion on one's desire to move about in relative peace and quiet. 

Public cell phone users succeed in poking a lot of holes in the very notion of personal privacy that so many individuals claim they want.  Further, protecting one's conversation from being overheard by others appears to be nonexistent.  Indeed, one could argue successfully, that many cell phone users, in particular, have a narcissistic need "put their business in the street."  This trend does not discriminate by gender, class, profession or economic standing. Unfortunately, public cell phone use/abuse operates to dilute  what is known in the law as an individual's "expectation of privacy."

On a recent trip on a local commuter train an older, well-dressed man sat next to me.  After settling in, he proceeded to call a lawyer associate of his to discuss a pending legal matter.  This man, I later learned, was himself a lawyer.  His conversation consisted of his literally shouting into his cell phone.  He discussed, what I knew to be very sensitive details of client conversations and other pertinent facts of the case.  It occurred to me that this lawyer's myopic, self-centered behavior may have compromised, if not destroyed the attorney-client privilege.  After all, he didn't stop to think that one of the other passengers riding in that car - including myself - might have been an interested party in the case who was favorable to the litigants on the other side. 

Bottom line, before you use your cell phone in public, you may want to take pause and determine:

• the nature of the conversation - is it business, pleasure, or a little of both?
• whether your conversation is confidential in nature
• whether your conversation, if heard by others, could harm business or others
• whether your cell phone might play a role in destroying a privilege protected by law such as attorney-client, priest-penitent, husband-wife, if your conversation is overheard by others familiar with your situation

While cell phone are conveniences of the modern age, they also can serve to dilute individuals' claims of privacy if more discreet care while using those phones are not employed. 

Small Businesses Need Privacy Policies, Too

Privacy compliance is believed to be applicable to large corporations.  However, if your small business hosts a website to promote and sell your products and services, then you need to comply with U.S. privacy laws.

Financial services companies such as banks and brokerage firms are required under federal privacy rules to disclose their privacy practices annually to particular categories of individual customers.  Corporate accounts are exempt from privacy notification requirements.  Annual privacy notices are included generally with the customer's monthly statement.  In some instances, the notice may be mailed separately as a stand-alone piece.  Email is a delivery mode only is the customer has opted to receive the notice in that manner or email is the primary medium by which the bank or brokerage firm communicates with that particular customer.

Small and medium-sized businesses that offer non-financial goods and services are not required to send annual privacy notices.  As mentioned earlier, if your market and sell your products online, then your website needs to have an online privacy policy in place.

Why Is This Important?

By their very nature, eCommerce websites are designed to collect personal information about visitors to the site using several different methods:

• Registration: Some sites ask first-time visitors to complete an online form that asks for the person's name, address, city,state, phone number.  Depending on the site, other personal data may be requested, such as date of birth, country of citizenship, or the types of products and services the person may be interested in purchasing from you.
• Cookies: Cookies recognize your computer each time the person returns to your website.  In addition, cookies serve to assist in improving the site's content and may help to personalize their experience while navigating your offerings.
• Check Out: If your site allows visitors to make purchases online, then your have some mechanism for them to do so.  For example, PayPal.  In the Check Out section, you collect the individual's credit card information, billing address and shipping information.

As your website continues to attract visitors and fill orders, you continue to collect individuals personal information.  Many small and mid-sized businesses contract with an unaffiliated third party whose specialty is website management and database storage.  Because your site collects personal financial data, you are required to disclose to your customers and visitors what you do with that data and whether their data is handled by a third party in any way.  In the event you use an outside vendor to manage your customer data, you also need to disclose the vendor's role and their limited access to that data.  In short, you need to let your customers know whether you share or sell their personal data with other parties and why you do so.

Your Privacy Policy

Websites for small and medium-sized businesses tend to have a link to a privacy statement  as part of their website.  To ensure you are complying with privacy disclosure rules, be sure your online privacy policy includes the following information:

1. What personal information you collect about visitors to your site
2. Whether you disclose that personal information to affiliated businesses or to third parties (including individuals)
3. How you limit use of customers personal information by affiliates and/or third parties
4. A toll free number, URL and/or mailing address in the event the customer has any questions about your privacy practices.

Most importantly, your privacy policy and adherence to privacy compliance is an excellent way to build customer loyalty and trust.  As a best practice, re-visit your privacy policy at least every six months to ensure your statements are relevant and that you have adequate controls in place to safeguard your customers personal financial information.  Finally, engage a privacy consultant who can help you draft your online privacy policy and keep you abreast of any changes in global privacy rules.