Is it time for a chief privacy officer?

Internet Strategies for Education Markets: The Heller Report, Nov, 2001 by Angela Clancy

Companies with educational web sites now need to recognize that staying on top of, and in compliance with, all relevant privacy laws is an essential part of running their online business. One incarnation of the growing trend is the new position of chief privacy officer, or CPO.

Attorney and privacy consultant Ray Everett-Church was likely the first corporate CPO in the U.S. in his 1999 role with AllAdvantage. He recommends that, "companies should designate someone as a CPO to be responsible for managing privacy responsibilities across the enterprise."

Everett-Church notes that the CPO's role includes working closely with the company's creative, legal, business development and marketing departments, as well as with outsourced providers of privacy-enabling technology and services. "Someone in the role of a privacy officer is often required to act as a negotiator between different departments and service providers to make sure a company is compliant with applicable law, while making sure everybody can keep moving towards their business goals."

A company's CPO must consider not only existing legislation, but also pending legislation that could significantly impact profitability. For example, if passed, the proposed Student Privacy Protection Act will require all schools receiving Elementary and Secondary Education Act funding to obtain written parental consent before non-educational service and product providers can use student information -- whether personal or aggregate -- for any marketing purposes.

By centralizing the management of relevant privacy information, a CPO can reduce multiple departments' duplication of efforts and ensure that someone is taking responsibility. Accessible, company-wide impact analysis by the CPO can help managers make better decisions and develop strategies for maximizing the permissioned and responsible use of customers' personal and aggregate data.

The CPO or privacy point person should also monitor the implementation of the Platform for Privacy Preferences (P3P). P3P will likely become the industry standard for integrating privacy management into user's Web browsers. It would automatically compare a Web surfer's specified privacy preferences with a site's privacy policy and highlight inconsistencies. In order to accommodate this new technology, companies will have to devise computer readable privacy policies and implement them on every site they operate.

Managing privacy issues is a big responsibility. Even if a company dedicates resources to implementing proper privacy procedures, little things can be missed. FTC fines, bad PR and the revocation of privacy seals are bad enough; equally burdensome are the potentially costly lawsuits that are now beginning to surface.

At the least, conducting an annual assessment of your company's privacy practices can help nip problems in the bud. For a fee, groups such as TRUSTe (San Jose, CA, www.truste.org), the Better Business Bureau's BBBOnline (Arlington, VA, www.bbbonline.com) and the entertainment Ratings Software Board (New York, NY, www.esrborg.com) provide assessment services and reward qualifying web sites with their seal of approval.

Navigating the Legislative Waters

Legal requirements for children's privacy are growing. In a recent policy speech, Timothy Muris, the recently appointed chairman of the Federal Trade Commission, charged with enforcing the Children's Online Privacy Protection Act (COPPA), announced dramatic increases in children's privacy enforcement, including 30 new full-time investigators.

Paramount to the FTC's priorities this year will be the prevention of personal information collection from children without parental or teacher consent. "Parents do not want information on the whereabouts of their children to be freely available," he warned. Already this year the FTC has imposed a number of civil penalties under COPPA, and issued numerous other warnings.

Beyond the current laws, as many as 300 bills related to internet privacy have been considered by state legislatures (and another 50 in the US Congress) within the last 6 months, including the Electronic Privacy Bill of Rights Act which would require consumer consent for all data sharing by Web sites. The FTC estimates that approximately 3.6 million Web sites collect personally identifiable information.

The Market Advantage of Compliance

Educational web sites are likely to pursue compliance as a market advantage. "Companies' privacy officers are coming to us for more than outsourced COPPA compliant registration and permissions management," says Denise Tayloe, CEO of Privo (Washington, DC, www.privo.com). "They're looking to make privacy a competitive advantage and to show parents and teachers they're going above and beyond the letter of the law."

Privo specializes in enabling companies to have safe and profitable online interactions with children. Tayloe notes that balancing marketing and privacy practices "depends on a company's customer relationship strategy."

"Education technology today is about creating interactive products and services with flexibility," remarks Joan Fenwick, head of AT&T Learning Network (Basking Ridge, NJ, www.att.com/learningnetwork). "The companies that will succeed will be the ones that offer the best overall educational value for the best price with the ability to be easily integrated into existing class objectives. These programs are some of the most exciting uses of technology in teaching but teachers will demand flexible privacy and. security options that can be tailored to their local needs. All education is local and personal. So is privacy."