IBM: Privacy Is Still Top Of MindIBM: Privacy Is Still Top Of Mind

IBM this week will boost its efforts to develop technology that helps ensure privacy and data security for companies that do business on the Internet. It has created an internal group, the IBM Privacy Institute, as well as a Privacy Management Council consisting of IBM executives and top customers, to guide development of IBM privacy-and security-management software.

New laws that broaden the government's power to hunt terrorists by monitoring Internet communications, such as the recently passed USA Patriot Act, in no way reduce businesses' obligation to protect customer privacy, says Harriet Pearson, IBM's chief privacy officer. Companies will continue to require state-of-the-art privacy and security tools, she says. "I still have a privacy policy posted on my Web site, our health-care providers still have confidentiality requirements, and our financial-services customers still have requirements to safeguard financial privacy," she says.

Among the customers taking part in the Privacy Management Council are Fidelity Investments, Marriott Hotels, Novant Health, and Travelers Insurance. Novant chief technology officer James Kluttz says the Charlotte, N.C., health-care facilities operator hopes to help IBM develop software that would let it more easily govern access to patient records. "You could imagine that we only want certain physicians to have access to certain records. We want to be able to control that at a very granular level," he says.

Safeguarding customers' privacy is becoming harder as more companies merge databases internally and across supply chains, says Arvind Krishna, VP for security solutions at IBM's Tivoli division, which will sell most of the forthcoming privacy and security tools. "Protecting privacy wasn't so difficult when you had companies using 15 disparate systems that didn't talk to each other," Krishna says. Collaborative businesses need software that can control access to data using preset criteria, he says. IBM is developing technologies, such as XML templates, that would let users distribute access-control policies to all systems within a supply chain. Privacy Management Council members will get early access to releases to test the software.