Quick Take: Mistakes Banks Make About PrivacyQuick Take: Mistakes Banks Make About Privacy

Financial-services companies face two standards when dealing with privacy issues: giving customers the level of privacy they want and giving them the type of privacy the government demands. But spending more time on customer desires can go a long way toward meeting compliance standards, says Dennis Behrman, an analyst at Financial Insights, which advises financial-services companies on technology issues. The Gramm-Leach-Bliley Act, being closely followed by the Health Insurance Portability and Accountability Act, has provided a highly visible example of regulated privacy. Behrman says many financial-services companies make similar errors in handling customer privacy, and their experience can help companies in other industries as they consider how to deal with privacy issues, whether or not they're regulated by law. The mistakes include:

• Assuming customers want to opt in or opt out. Many customers would prefer a choice in between giving the company carte blanche to share personal data and a blanket no. They'd prefer something more like a menu of privacy policies, just as they get a menu of services.

• Using convoluted and complicated language for privacy policies. Boilerplate statements meet legal standards. But they create customer confusion and suspicion.

• Looking at privacy as a database problem, instead of exploring the use of rules-based middleware engines and governance systems.

• Missing the chance to use privacy regulations as an opportunity to clean up customer data to deliver a broader business benefit. Behrman estimates 50%--and perhaps as much as 80%--of data captured on customers at a typical financial-services firm is never used.

Though Gramm-Leach-Bliley compliance first hit consumers in a big way with the often-confusing opt-out letters they received from banks and insurance companies, compliance issues haven't gone away. Behrman predicts spending on Gramm-Leach-Bliley compliance will rise from $50 million this year to $170 million in 2006. So there's still plenty of incentive to get privacy policies right.

Return to: Tech Guide: Privacy: Keeping Regulators Happy

Illustration by Doug Ross