Home > Identity Theft > How Businesses Can Get Serious About Privacy & Security

Comments 0 Comments

In May 2014, Gregg Steinhafel, Target’s President, CEO and Chairman of the Board, resigned following a 2013 data breach that resulted in the theft of 110 million credit and debit card transaction records. Seventy million of those records contained customers’ addresses and telephone numbers – putting those affected at risk of identity theft. Experts have predicted that the data breach has already cost Target up to $161 million – not taking into account any future penalties, credit monitoring expenses, loss of goodwill or lawsuits. The theft of Target’s customer data has also had a significant impact on the company’s profitability, which fell more than 40% in the fourth quarter, and is down 46% from the previous year.

Personal information and customer trust are critical assets, which businesses of all sizes must take an active role in protecting. The privacy and security of customer data cannot be simply left to chance. Once you have lost your customers’ trust, you have lost their business, and that negative “word of mouth” can either make or break a product line, brand or even an entire company. With the appropriate security and privacy protections in place, however, Target’s massive privacy breach – and the associated harm to customers – could have been avoided.

Rapid innovation, global competition and increasing system complexity present profound challenges for businesses in protecting the privacy of their customers. All too often, organizations focus on securing their data assets while protesting that implementing strong privacy measures will stifle innovation, increase costs and diminish the bottom line of their business. While security is an essential element of privacy, it is not enough – privacy and data protection incorporate a much broader set of protections.

While the disciplines of security and privacy are closely related, they are not, however, synonymous. Privacy seeks to respect and protect personally identifiable information by empowering individuals to maintain control over its collection, use and disclosure. Information security seeks to enable and protect activities and the assets of both people and enterprises. As the value of information and the need to manage it responsibly grows dramatically, it is more important than ever for organizations to incorporate both privacy and security into their networked data systems and technologies as the default settings.

Privacy by Design

The Privacy by Design framework, which has now been translated into 37 languages, employs an approach that is characterized by proactive rather than reactive measures. It anticipates and prevents privacy-invasive events before they happen. Privacy by Design does not wait for privacy risks to materialize, nor does it offer remedies for resolving privacy infractions once they have occurred − it aims to prevent them from occurring. In short, Privacy by Design comes before the fact, not after. In October 2010, regulators from around the world gathered at the annual assembly of International Data Protection Authorities and Privacy Commissioners in Jerusalem, Israel, and unanimously passed a landmark resolution recognizing Privacy by Design as an essential component of fundamental privacy protection.

When Privacy by Design was created back in the ‘90s, the notion of embedding privacy into the design of technology was far less popular – taking a strong regulatory stance was the preferred course of action. This did not reflect the realities of the online world in terms of connectivity, mobile and ubiquitous computing. It was clear that a new framework needed to address the ever-growing and systemic effects of information technologies, and of large–scale networked data systems. The premise of Privacy by Design is “positive-sum” — that you can accommodate multiple interests at the same time. Not in an “either/or”, one versus another interest model such as privacy versus security, but in a “positive-sum” model meaning you can have positive increments in two functionalities at the same time — privacy and security together!

Organizations that embrace a proactive Privacy by Design approach — embedding privacy into information technologies, business practices and networked infrastructure at their nascent stages – will experience a number of positive business effects, including gains to one’s reputation, improved customer service and most importantly, enhanced customer confidence and trust in their business. Privacy by Design advances the view that the future of privacy cannot be assured solely by compliance with legislation and regulatory frameworks; rather, privacy assurance must ideally become an organization’s default mode of operation.

Security by Design

The old ways of simply building a defensive perimeter around a data resource are no longer sufficient. Security must go on the offensive and address information security concerns as the default mode of operation.

The concept of Security by Design, which I explored in two white papers written with Oracle in 2013, highlights the need to design software systems that are secure, from the ground up, minimizing the impact of a breach when a security vulnerability is exploited, thus preserving privacy in the process. In order to become a reality, Security by Design – like Privacy by Design – requires strong leadership, continuous goal-setting and consistent follow-through. Ensuring security and privacy is an ongoing journey, not a single project or a disjointed set of loosely related projects.

To provide guidance for organizations, we established a set of foundational principles for Security by Design, which are modeled upon and support the seven foundational principles of Privacy by Design, which outline an enterprise-level process for defining and governing the strategic journey of Security by Design.

Good Privacy and Security Equals Good Business

One of the most important elements in the relationship between a business and its customer is trust. By taking a proactive approach, it is indeed possible, and far more desirable, to embed both privacy and security. The best path is to gain a competitive advantage – make privacy pay off by embedding privacy, side by side, along with security.

More on Identity Theft:

This story is an Op/Ed contribution to Credit.com and does not necessarily represent the views of the company or its affiliates.

Image: Pixsooz

Comments on articles and responses to those comments are not provided or commissioned by a bank advertiser. Responses have not been reviewed, approved or otherwise endorsed by a bank advertiser. It is not a bank advertiser's responsibility to ensure all posts and/or questions are answered.

Please note that our comments are moderated, so it may take a little time before you see them on the page. Thanks for your patience.

Credit.com receives compensation for the financial products and services advertised on this site if our users apply for and sign up for any of them.

Hello, Reader!

Thanks for checking out Credit.com. We hope you find the site and the journalism we produce useful. We wanted to take some time to tell you a bit about ourselves.

Our People

The Credit.com editorial team is staffed by a team of editors and reporters, each with many years of financial reporting experience. We’ve worked for places like the New York Times, American Banker, Frontline, TheStreet.com, Business Insider, ABC News, NBC News, CNBC and many others. We also employ a few freelancers and more than 50 contributors (these are typically subject matter experts from the worlds of finance, academia, politics, business and elsewhere).

Our Reporting

We take great pains to ensure that the articles, video and graphics you see on Credit.com are thoroughly reported and fact-checked. Each story is read by two separate editors, and we adhere to the highest editorial standards. We’re not perfect, however, and if you see something that you think is wrong, please email us at editorial team [at] credit [dot] com,

The Credit.com editorial team is committed to providing our readers and viewers with sound, well-reported and understandable information designed to inform and empower. We won’t tell you what to do. We will, however, do our best to explain the consequences of various actions, thereby arming you with the information you need to make decisions that are in your best interests. We also write about things relating to money and finance we think are interesting and want to share.

In addition to appearing on Credit.com, our articles are syndicated to dozens of other news sites. We have more than 100 partners, including MSN, ABC News, CBS News, Yahoo, Marketwatch, Scripps, Money Magazine and many others. This network operates similarly to the Associated Press or Reuters, except we focus almost exclusively on issues relating to personal finance. These are not advertorial or paid placements, rather we provide these articles to our partners in most cases for free. These relationships create more awareness of Credit.com in general and they result in more traffic to us as well.

Our Business Model

Credit.com’s journalism is largely supported by an e-commerce business model. Rather than rely on revenue from display ad impressions, Credit.com maintains a financial marketplace separate from its editorial pages. When someone navigates to those pages, and applies for a credit card, for example, Credit.com will get paid what is essentially a finder’s fee if that person ends up getting the card. That doesn’t mean, however, that our editorial decisions are informed by the products available in our marketplace. The editorial team chooses what to write about and how to write about it independently of the decisions and priorities of the business side of the company. In fact, we maintain a strict and important firewall between the editorial and business departments. Our mission as journalists is to serve the reader, not the advertiser. In that sense, we are no different from any other news organization that is supported by ad revenue.

Visitors to Credit.com are also able to register for a free Credit.com account, which gives them access to a tool called The Credit Report Card. This tool provides users with two free credit scores and a breakdown of the information in their Experian credit report, updated twice monthly. Again, this tool is entirely free, and we mention that frequently in our articles, because we think that it’s a good thing for users to have access to data like this. Separate from its educational value, there is also a business angle to the Credit Report Card. Registered users can be matched with products and services for which they are most likely to qualify. In other words, if you register and you find that your credit is less than stellar, Credit.com won’t recommend a high-end platinum credit card that requires an excellent credit score You’d likely get rejected, and that’s no good for you or Credit.com. You’d be no closer to getting a product you need, there’d be a wasted inquiry on your credit report, and Credit.com wouldn’t get paid. These are essentially what are commonly referred to as "targeted ads" in the world of the Internet. Despite all of this, however, even if you never apply for any product, the Credit Report Card will remain free, and none of this will impact how the editorial team reports on credit and credit scores.

Your Stories

Lastly, much of what we do is informed by our own experiences as well as the experiences of our readers. We want to tell your stories if you’re interested in sharing them. Please email us at story ideas [at] credit [dot] com with ideas or visit us on Facebook or Twitter.

Thanks for stopping by.

- The Credit.com Editorial Team