Privacy Trends

The widespread use of Social Security Numbers creates genuine problems for individuals, and I expect more direct protection of that information. California has adopted a law that prohibits many uses and transmissions of Social Security Numbers, and this law may become the model for laws in other states. In this regard, the problem of identity theft looms large in the public and legislative eye. Specific protection of Social Security Numbers is one probable legislative reaction, but other measures, similar to the more general GLB protections, will be enacted. These measures will touch every business operation, including retail establishments.

The California law has a feature that could signal a direction for privacy legislation. It prohibits any requirement to transmit a Social Security Number (employee or customer) unless the number is encrypted or the site is secure. This type of interplay between privacy and electronic security will be a part of privacy legislation, and again it suggests that businesses have to invest in a certain amount of electronic hardware, software, and expertise.

"Customer relationship management" is a currently popular marketing theory that has achieved modest buzzword status. Each time a consumer has contact with a company, the company collects some information about the customer's buying preferences and patterns. Theoretically, the company can interpret all of that information and offer the customer the exact product or information he or she wants. This customer relationship management will be affected by privacy issues, as well. Companies that make an investment in hardware and software will be able to practice relationship management, while those that don't make the investment will be prevented. But beyond that, if privacy rules do trend toward individualization, then the laws may permit individuals to tell the companies to leave them alone. Then a company's computers will need to be able to cut that customer out of the program.

The privacy provisions of GLB pertain to the intentional sharing of personal information. GLB also has security provisions that relate to the susceptibility of our information systems to intrusion. The security provisions of GLB are an issue in the insurance industry at this moment because state insurance departments are adopting regulations that conform to GLB. This development directly affects only people who work for the insurance companies that will adopt new security measures. I mention it here because improved security enhances consumer privacy, and those who work in industries that have information to protect can expect to see more security measures adopted.

National security interests in the form of the recently enacted U.S.A. Patriot Act compete with privacy interests. This law expands an existing requirement that banks and securities dealers screen transactions for possible connections with terrorist or narcotics trafficking groups. Now other industries that handle funds must also screen transactions. Suspicious transactions must be reported. The natural result is that some innocent individuals will find their privacy rights have been overcome by competing national security interests. For the foreseeable future, national security interests will nibble at the edges of privacy.

We are very likely to be affected in the U.S. by the privacy regime enacted by the European Union. The EU rules reach far beyond financial and medical institutions and require every industry to limit the sharing of personal information. Specifically, the laws prevent the transmission of personal data into a country whose laws do not offer certain protections for that data. If the complete regime were to be enforced, multinational companies, whether they sell insurance, chemicals, or soft drinks, won't be able to transfer customer or employee data without being concerned about privacy. While it hasn't hit yet, I suspect this is the next step. European companies may be prevented from doing business with U.S. companies unless the U.S. companies can guarantee they provide the same protections the European laws provide.

Currently, this blockade is interfering with some international trade. Many U.S. companies that operate internationally have adopted the European rules. International trade groups and governments are negotiating over this issue, but the result will probably be that U.S. corporations will have to comply or accommodate because, while the European Union may soften its position, it will not give in completely.

All U.S. companies, not just financial institutions, that want to sell goods and services in Europe will have to put privacy programs into place.

I expect more privacy protections for employees. Most companies have codes of ethics and conduct that protect the confidentiality of human resources files, but very few laws mandate confidentiality. If legislatures keep privacy on their agendas, then we can expect laws requiring companies to adopt a privacy program that protects the information that employers collect about their workers.