Data security consistently tops the laundry list of security priorities because it must. Organizations are collecting data, creating data, using data, and storing data in some way or another. Mishandle data or disregard privacy, and you’ve got a public relations fiasco on your hands with the potential to disrupt business operations or hurt the bottom line.
So, we know that data security is a priority, but what does that mean? What are organizations actually doing here? How much are they spending, and where are they focusing their efforts? And what are they doing about privacy? I’ve dug into data from Forrester’s Forrsights Security Survey, Q2 2012 and data from the International Association of Privacy Professionals (IAPP) to answer these questions in a newly published benchmarks report for our Data Security and Privacy playbook. Note: This is not a shopping list, nor a check list, nor is it a “spend x% on data security because your peers are doing so!” manifesto. This report is meant to be a starting point for discussion for S&R pros within their organizations to take a closer look at their own data security and privacy strategy.
I spent a jam-packed day with security software and services provider AVG last week, checking out their 2013 product line-up for free antivirus and paid premium products, and participating in roundtable discussions with press, analysts, and AVG executives about consumer security, mobile, privacy and policy. Here are my reactions to what AVG is doing:
LIKE: Consumer data (yes, I’m biased here, being the data nerd). AVG has lots of it and it’s all free. This is awesome because it’s a great resource not just for the industry but for other parties to use in education and awareness program design. They’ve done studies across 11 countries for their Digital Diaries studies, surveying parents and kids of different age brackets from 0 to 17 to understand online behaviors and attitudes. Here’s a data nugget that caught my attention: by the time they are two years old, 81% of children have some kind of digital footprint (online photographs, personal data, email and/or social networking accounts). 81%!
Eighteen months ago, when I started down the path of what would become our body of Personal Identity Management (PIDM) research, there were only a few customer intelligence professionals who gave much credence to the picture we were painting. What a difference a year makes. Today, privacy, data governance, consumer empowerment, and understanding "the creepy factor" are core to the conversations I have with CI pros in both marketer and vendor organizations.
At the center of those conversations is often the question, "Who are the players in tomorrow's consumer data ecosystem?" We've just published a report, Making Sense of a Fractured Consumer Data Ecosystem, that reviews the strengths and weaknesses of four existing vendor categories plus three emergent business models. These include:
Consumer data giants: Companies, like Acxiom, Epsilon, Experian, and Infogroup, that have an opportunity to become consumer-friendly data managers but are at greatest regulatory risk
Reputation management providers: Companies, like Intelius and Reputation.com, that could help consumers manage data access but need to focus on their B2C business models to do so
Online services giants: Companies, like Google, MSN, and Yahoo, that already have access to highly personal data but serve too many masters
Yesterday, the White House released a long-awaited set of recommendations that are focused on helping individuals take greater control of how their data is collected and used for online marketing purposes. It includes what's being referred to as a "Consumer Privacy Bill of Rights."
The language is vague. The timeline to completion is long. The guidelines, for now, are "opt-in" for organizations. All true.
But folks? The glory days of scraping and selling and repurposing customer data are over. The Oval Office has spoken on the issue of privacy and personal data, and its bill of rights is crystal clear: Tell me what you’re collecting, how you’re using it, protect it well, give me a copy, and give me a chance to correct it, delete it, or opt out entirely.
Now, as a customer intelligence analyst, I preach a “consolidated view of the customer” to clients nearly every day. I advise retailers, CPGs, and others that creating an optimal experience for customers is nearly impossible without having a clear understanding of their needs and preferences, across all channels and lines of business. But what Google’s doing extends well past traditional “single view” and into “personal data locker” territory.
On the face of it, Google claims that it’s making these changes for the same reason: to improve the user experience. But to remain profitable and keep providing free services to several hundred million users, Google will also use its vastly increased insight about users to sell better targeted (read: more expensive) ads to advertisers.
Over the weekend, one of the most reputable online retailers in the US, Zappos, broke the news that its database was hacked and that the information for about 24 million user accounts was breached.
How do stories like this affect consumers’ attitude toward online privacy? In our August 2011 Community Speaks Qualitative Insights report, “Consumer And Online Privacy: How Much Information Is Too Much?” (available for Community Speaks subscribers only), we found that online privacy is one of the most concerning topics in online users’ minds. Two-thirds of US online consumers report being very concerned about the recording and collection of their personal details by websites.
Most marketers and customer intelligence (CI) pros tend to lump together most types of customer data. Sure, things like passwords and social security numbers are considered more "sensitive," but for the most part, the systems that protect all the data -- and the privacy policies that communicate their capture and governance -- are largely the same.
Individuals see different types of data differently -- they're most worried about what we consider individual identity data, and far less concerned about the capture and use of their behavioral data.
Most consumers are willing to share their data in exchange for value. But, what they consider "valuable" is very age-dependent -- in other words, the same consumer isn't equally motivated by discounts and cash rewards.
Carrier IQ software, which consists of embedded software on mobile devices and server-side analytics applications, enables mobile operators and device OEMs to understand in detail a wide range of performance and usage characteristics of mobile services and devices. These include both network-facing services such as core voice and data offerings, as well as non-network-facing capabilities such as music players, cameras and other side loaded media, in order to assist with product and service development and roll-out [emphasis added].
Customer Intelligence is not a spying operation. The promise of CI is not reductively commercial. Instead, proper CI practices help businesses – with their customers' consent – to understand the preferences and needs of their customers. Firms also use CI processes and technologies to determine and enforce an optimal and respectful relationship with customers.
What lessons does the Carrier IQ incident highlight?
CI pros have an ethical responsibility to customers.CI pros are customer advocates after all. They cannot truly represent customers unless they also help their employers understand appropriate boundaries for data capture. Helping customers also helps businesses, protecting firms from the risk of public outrage and litigation. CI pros: Help your employers understand when data capture goes too far.
It has been a few years since Forrester delved deeply into the issues surrounding consumer privacy, and in that time, an awful lot has changed:
Facebook Connect, Google ID, Yahoo Identity, and Sign In With Twitter have emerged as a wholenew way of being recognized across a myriad of websites across the Net. As little as a decade ago, most adults online couldn’t have imagined the convenience of single sign-on.
At the same time, data capture methods have not only proliferated, they’ve become exceptionally sophisticated. Tactics like Flash-based cookies and deep packet sniffing surreptitiously collect behavioral data about online consumers, while loyalty and membership cards provide more insight into consumers’ purchasing habits at the line item level than ever before.
All that extra data is hard to protect without big changes to governance policies and technology stacks, and when data breaches happen, they're public and ugly.
Finally, legislators have forged ahead with regulations to protect consumer data. Europe's answer is the Data Protection Directive – a regulatory framework that governs the capture, management and use of consumer data, while in the US, congressional leaders, egged on by consumer advocacy groups, are introducing bills designed to limit data capture and to provide remediation in cases of data and security breach.
Maps and navigation are not yet mainstream, but they are more useful as product features anyway. This means that location is no longer a service like maps or navigation but is increasingly an enabler of new product experiences.
Location and maps are increasingly becoming features of new mobile products and services.
Location will happen automatically, behind the scenes. Adjustments will be invisible from a user perspective (think about the automatic weather update on your home screen widget).
Relevancy of local data will improve quickly. The era of basic point of interest (POI) information is over. Enriching addresses with more accurate information on opening hours, real-time data (traffic information, promotions, etc.), product/brand data, dynamic data (consumer reviews, inventory information) will deliver greater consumer benefits.
New algorithms will bridge the physical and digital worlds. Coupling more accurate local data with user context and other sources of information will foster the development of crowdsourcing and predictive analysis (e.g., predicting traffic congestion or air quality monitoring). Moving forward, these new algorithms will have far-reaching consequences well beyond mobile.