- Advice Summaries
- Case Notes
- Codes of Conduct
- Compliance Notes
- Fact Sheets
Good privacy is good business
Speech by Karen Curtis, Privacy Commissioner, Office of the Privacy Commissioner. Delivered to New Zealand Privacy Issues Forum, 30 March 2006.
Thank you very much for the opportunity to talk to you. I''m delighted to be here.
Like most Australians, I have a great affinity with New Zealand. I first visited here almost 30 years ago - obviously as a child - and have been here numerous times over the intervening years.
Some of the characteristics, I believe, that makes New Zealand and Australia alike are the overwhelming belief in the importance of the rule of law, and fairness, and a commitment to democracy. I note that New Zealand has always been an enlightened place and not just because it''s one of the first places to see the new day!
New Zealand features highly in many world tables. I understand that New Zealanders are the second biggest users of the internet in the world (Australians are 7th) and that Wellington and Auckland were ranked in the top 20 in the World''s Most Liveable Cities Survey.
And it would be remiss of me if I did not mention New Zealand and the leading role it has played with women. In 1893, New Zealand was the first nation in the world to give women the vote and today you continue that tradition with women as Governor General, Prime Minister, and of course as Privacy Commissioner.
In privacy league tables I note the extraordinary standing of, and respect for, your Commissioner Marie Shroff and the ''privacy guru'' status of your Assistant Commissioner, Blair Stewart. I thank Commissioner Shroff for inviting me to speak to you today.
What I have been asked to talk about today is why good privacy is good business.
I personally agree with that sentiment and it is also something that my Office has had as somewhat of a mantra since developing its strategic plan in 2000. It has been one of our four slogans and along with ''respecting privacy'' has been the most used.
To make the case for good privacy is good business I will draw on international experiences, the community attitudes research commissioned by my office in 2001 and 2004, the information gathered in my 2005 review of the private sector provisions of the Australian Privacy Act, and the recommendations from that review.
By examining the evidence, I propose to give you three key messages, three compelling reasons why it is accurate to say that good privacy is good business. These are:
- risk to brand and reputation damage;
- possible customer and business partner attrition; and
- the value of information.
Being a profitable business and complying with privacy laws are not incompatible, they are not mutually exclusive, and indeed can be a successful partnership.
There are of course other reasons why good privacy is good business including:
- Pragmatism - reducing the risk of more regulation. Few businesses would want a greater compliance burden with more prescriptive law.
- Avoiding potential legal costs and penalties - Most businesses would want to avoid the legal problems and costs of not complying with existing laws. No organisation wants to incur costs by dealing with numerous complaints or being involved in court cases.
- Staff morale. An organisational culture that respects privacy can give a business the real but often intangible benefits of a happy and productive workforce.
- Corporate social responsibility. Leading businesses are aware of the CSR principles of operating a business in a manner that meets or exceeds the ethical, legal, commercial and public expectations that society has of business.
Finally, I will also outline some steps for organisational leaders to take to make privacy an important part of organisational culture.
Definition of privacyBut, firstly a definition of ''privacy''.Privacy is not rocket science. It really is a simple notion about respect, choice and common sense. It is about balance - balance between the right of an individual and collective society needs. Indeed, Australian legislation says that privacy is to be balanced against competing social and business interests - the free flow of information and the right of business to operate efficiently. Privacy can be divided into four categories:
- Physical privacy - protection of our physical selves against invasive procedures;
- Territorial privacy - setting limits on intrusion into domestic and other environmentslike nosy neighbours;
- Privacy of communications - security and privacy of mail, phones etc;
- Information privacy - involving rules for the handling of data.
In Australia, my role extends primarily to information privacy. I believe it would be better if the title of the Act reflected what it is I do, and be called the Data Protection Act or the Information Protection Act.
In general terms, the Australian Privacy Commissioner has responsibilities under the Privacy Act and other federal legislation to regulate the way federal government agencies and private organisations collect, use, store and disclose people's personal information. This is done by 11 Information Privacy Principles for the public sector, and similar but not the same, 10 National Privacy Principles for the private sector. The private sector was brought into the ambit of the legislation in December 2001.
I used to think of myself as a PEAR - promoting, educating, advising and regulating - PEAR - sometimes tart, sometimes sweet but always crisp and clean!
But now after almost 2 years in the role I''ve evolved from a fruit into a person, and I like to think of myself as the princess of privacy:P - promote R - regulateI - investigateN - nous on new technologies C - conduct researchE - educate and engage S - speak S - solid and sensible non-subjective advice
My approach as Commissioner is to concentrate on:
- Effective and efficient administration of my Office and the relevant legislation;
- Influencing development of government policy;
- Education and awareness within the wider community;
- Being a clear and balanced voice on privacy.
Private Sector Legislation
In introducing privacy legislation to cover the private sector, the then Attorney General called it a ''light touch'' approach to privacy protection. Parliament established a co-regulatory regime which was intended to be responsive to both business and consumer needs. This was to be achieved by using high level principles rather than prescriptive rules and by encouraging organisations and industries to develop their own privacy codes.
Our privacy laws are not complicated and difficult. I believe they achieve a balanced policy outcome. As Benjamin Franklin said:
"Laws too gentle are seldom obeyed; too severe, seldom executed."
I define ''Good privacy'' as not just about complying with the relevant privacy laws. It is about best practice, and ensuring the business goals are met in a way that respects the personal information the business collects, uses and discloses. Awareness of privacy should be built into the culture of an organisation. Education and awareness about obligations and rights are essential to an effective privacy regime.
A seminal piece about privacy in Australia which also influenced the development of the New Zealand law is the 1983 Australian Law Reform Commission''s report on privacy. It stressed the need for community education in basic privacy standards: ''In the longterm, this education may be more effective in preserving privacy than in the passage of laws.''
In my March 2005 review of the private sector provisions ''Getting in on the Act'' I was pleased by many of the submissions I received about how many businesses dealt with privacy. One business - Suncorp Metway - advised that passing a privacy module was part of the probation process for any new staff.
This is a very practical way to ensure that privacy is inculcated into a business'' practices. More of that later.
I was also heartened by the very broad business support for the high level principles approach, which many businesses saw as the best approach to allow Australian businesses to adopt practices that are tailored to individual businesses while providing consumers with an assured level of privacy. This comment was from Microsoft Australia, part of a global icon, which was supported by the association representing car repairers and small petrol station owners (the Victorian Automotive Chamber of Commerce). The VACC said the principles based approach allows each business the opportunity to identify its own business practices and to apply the principles to them.
Vodafone Australia also endorsed the approach as providing adequate levels of privacy protection without imposing unnecessary compliance costs on business.
Almost universally in the submissions, in the business forums and in the public consultations there was no call for a repeal of privacy legislation. There was at least an acceptance of it, if not considerable support for it. These sentiments supporting the principles based approach recognise that good privacy is good business.
I will now turn to some international experiences. There was no shortage of material from overseas to assess the impact on business of poor privacy practices.
I''ll give you three examples from the United States.
In 2000, DoubleClick, an online advertising company, found out the hard way what happens when a company gets its privacy practices wrong.
DoubleClick decided it would match the personal information of people it had anonymously profiled on-line with identifying personal information collected off-line by Abacus Data, an aggregator of mail-order buyer information that DoubleClick had bought.
Not surprisingly, this caused a backlash amongst web users and people who bought items through mail-order catalogues which drew the attention of the US Federal Trade Commission, led to law suits and saw a dramatic drop in DoubleClick''s share price from $US 135 per share to mid $US 30s within 6 months.
A year later the company dropped plans to merge the data, settled all law suits agreeing to pay $US1.8 million in legal costs, and agreed to purge their databases and to conduct an online privacy education campaign.
When the company was sold in 2005, the share price was $US 8.50 per share. I am not suggesting that the mishandling of privacy was the only reason for the dramatic fall in share price, but it certainly was a factor.
Another US example highlights the importance of making privacy protection a fundamental aspect of business.
ChoicePoint is one of America largest personal information data aggregators with more than 19 billion records. These records include names, addresses, social security numbers, phone numbers, drivers'' licences, car registrations, credit histories, birth certificates, real estate deeds, insurance claims, thumbprints, and even DNA. It accumulated this information by buying a series of well targeted businesses. Clients of ChoicePoint ranged from the boy scouts to the CIA.
ChoicePoint received a lot of negative media attention when it became public that it had sold information to a confidence artist from Nigeria posing as several small business owners who used the information to create fraudulent identities.
On 26 January this year the US Federal Trade Commission fined ChoicePoint $US 15 million for a security and personal information breach involving the records of more that 163,000 people which led to more than 800 cases of identity theft.
The FTC found that:
ChoicePoint did not have reasonable procedures to screen prospective subscribers, and turned over consumers'' sensitive personal information to subscribers whose applications raised obvious ''red flags.'' Indeed, the FTC alleges that ChoicePoint approved as customers individuals who lied about their credentials and used commercial mail drops as business addresses.
ChoicePoint had been warned about its practices in 2001 but failed to heed the warnings.
As part of the FTC''s ruling, ChoicePoint agreed to:
- Implement new procedures to stop bogus businesses compromising their systems again;
- Totally re-vamp their security program; and
- Be audited by independent 3rd parties every two years for the next 20 years!
Larry Ponemon, Chairman and founder of the Ponemon Institute (a research think tank dedicated to advancing privacy and data protection practices), says ChoicePoint have learned their lessons and made changes but ''It's not because of altruism â€¦ they can't afford to have a brand meltdown over this again."
FTC chairman Deborah Platt Majoras said:"The message to ChoicePoint and others should be clear: Consumers' private data must be protected from thievesâ€¦. Data security is critical to consumers, and protecting it is a priority for the FTC, as it should be to every business in America."
Before news of the breach, ChoicePoint''s stock was selling for about $45 a share. It quickly dropped into the high $30s. Following the FTC''s ruling, shares fell about 7%. The stock is now trading at about $43 a share.
Unfortunately privacy and security breaches are not uncommon in the US. Since 15 February 2005, when the ChoicePoint breach occurred, the Privacy Rights Clearing House have been keeping a log of privacy and security breaches. In the last year they have documented 147 breaches involving the personal information of more than 53 million people.
Clearly there are some businesses behaving badly, and appropriately they are paying for it which fits my assertion that good privacy is good business.
In the third US example, what appears to be the biggest data breach in history, on 17 June 2005, CardSystems Solutions (a credit card processing company that had clients such as MasterCard, Visa and American Express) announced that during late 2004 malicious computer code had been loaded onto its system allowing hackers to access the credit card numbers of more than 40 million people.
Within a month of the breach, Visa and American Express dropped CardSystems as their credit card processor saying that CardSystems had violated their security agreements by keeping customer data on file following transactions.
In July 2005, CardSystems said it now faced ''imminent extinction.''
In meetings with CardSystems, following the breach, MasterCard demanded that CardSystems develop and implement a detailed security plan to meet MasterCard''s security requirements. MasterCard then met with CardSystems every week to monitor progress.
CardSystems then found itself in court facing a class-action lawsuit to preserve evidence related to a major breach of the Atlanta credit-card processor's computer systems.
This again demonstrates one of my key premises is that you can have business partner attrition which is damaging to an organisation''s bottom line if privacy is not looked after.
So, do consumers really pay attention to these breaches?
According to numerous consumer surveys the answer is an emphatic ''yes''!
A report in The Register stated that:
â€¦one in five US consumers quizzed by Ponemon Institute said they immediately terminated their accounts with vendors that lost their information.
An additional 40 per cent polled by the organisation's National Survey on Data Security Breach Notification considered taking their business elsewhere after receiving notifications of information mishandling. The survey polled 9,000 consumers, 12 per cent of whom had received notices of information security breaches.
A parallel study conducted by Ponemon estimates an average cost of $US 14 million per security breach incident, with costs ranging as high as $US 50 million. The survey, Lost Customer Information: What Does a Data Breach Cost Companies? is among the first to look at data from actual cases of lost customer data. Covering 14 separate incidents, the research encompasses 1.4 million compromised data records and an estimated total of $US 200 million in resulting losses.
Total cost estimates include the actual cost of internal investigations, outside legal defence fees, notification and call centre costs, PR and investor relations efforts, discounted services offered, lost employee productivity, and the effect of lost customers.
My own Office surveys have confirmed the importance people place on good privacy practice in business. In a survey we conducted in 2001, 42% of respondents said that they had decided not to deal with a business because of privacy concerns. As individuals become more educated about privacy laws and what their privacy rights are, good privacy practice for business will become increasingly important.
After these few reports it''s tempting to think that this is a problem only in the US.
In August last year, Australian Broadcasting Corporation''s Television program, Four Corners, ran a story that highlighted the risks to our personal information from hackers, crackers, phishers, skimmers and scammers, including that our personal information may then be on-sold without our knowledge or consent or used to defraud us.
At the centre of the program''s story was the allegation that Australians'' personal information, held in the customer database of Australian company Switch Mobile, was for sale on the black market in India. 
Within 24 hours of the story going to air the owners of Switch Mobile, a mobile phone service operator, were appearing on numerous TV programs explaining their side of the story, saying that they had already ceased contract negotiations with One Touch Solutions, who were going to conduct a marketing campaign to acquire new customers for Switch, and were looking into this matter. Within 48 hours my Office had begun investigations into the companies.
In any event, my investigation established that the personal information had been collected outside Australia, by a non-Australian company. This limits the action I can take however I have continued discussions with the two organisations.
The take-away message I have for organisations is the need to take rigorous steps to consider the protection of personal information, regardless of the business model used. Failing to do so can lead to the sort of adverse publicity suffered by both Switch Mobile and One Touch Solutions.
In other Australian examples, an online shopping store accidentally left customer phone numbers and email addresses open for scrutiny on the internet as did a ticketing company, while a high profile law firm published the personal details of job applicants on its site. All of these incidents attracted the attention of the Australian media.
The reporting of these incidents in the media helps to facilitate a fast rectification of the problem, and highlights for other businesses the importance of good privacy practices and the real potential for significant brand damage. As businesses come to recognise this potential for brand damage, it seems likely they will recognise the corresponding possibilities for brand enhancement engendered by privacy friendly practices.
Review of the Private Sector Provisions
As I said earlier, privacy is all about balance. This leads me to my report - Getting in on the Act - The Review of the Private Sector Provisions of the Privacy Act 1988.
This review was a timely and excellent opportunity to understand the Australian business experience in complying with the Privacy Act, and what the business community and the wider community thought generally of privacy.
In 2004-05, I undertook a review of the private sector provisions of the Privacy Act 1988. The private sector provisions became operational on 21 December 2001.
On the passage of the legislation the Government committed to review the private sector provisions to assess their effectiveness in safeguarding privacy after two years of operation. The Federal Attorney General gave me terms of reference on 13 August 2004. The review was submitted on 31 March 2005. The Government has yet to respond to my report in full but has responded to some recommendations. I will return to this point later.
Basically, the terms of reference for the review sought to find out whether the private sector provisions had met their objectives which included:
- the creation of a nationally consistent scheme for the regulation of privacy;
- meeting international concerns about Australia''s international obligations regarding privacy;
- recognising individual interests and;
- recognising other competing interests (such as business efficiency and the free flow of information).
Specifically excluded from the terms of reference of the review were genetic information, employee records, children''s privacy, electoral roll information and the political acts and practices exemption.
In the course of the review, we undertook broad consultation with the community, released an Issues Paper and received 136 submissions from a wide spectrum of stakeholders - business (large and small), business associations, federal state and territory departments and agencies, and consumer and privacy groups as well as many individuals.
We had a Review Steering Committee that met 4 times and a Review Reference group made up of 40 representatives from community, business and government which met 3 times. We also held 12 consultation forums in all capital cities and commissioned community attitudes research.
So with 7 months of research, consultation and input from the community, coupled with my Office''s experience over the previous three years, what were the findings of the review?
On balance, I found there is no fundamental flaw with the private sector provisions in the Privacy Act. The overall effect is that the National Privacy Principles have worked well and delivered to individuals protection of personal and sensitive information in Australia in those areas covered by the Act.
While finding no fundamental flaws, I did identify areas for improvement. The Report contains 85 recommendations stemming from a balanced and pragmatic examination of the Privacy Act. These recommendations should not be taken as dissatisfaction with the provisions. Rather, they are simply the benefit of three years experience where it has become apparent that there are ways of improving the existing elements of the regime and because there have been external influences which have impacted on the efficacy of the legislation.
The recommendations are written as actions the Australian Government should consider doing (with some in concert with states and territories), or as measures the Office could undertake.
The key recommendations are that:
- It is apparent that while the private sector provisions work well, given the principles are based on the OECD principles written in the late 1970s, it may be appropriate for the Government to undertake a wider review of privacy to ensure that in the 21st century the legislation best serves the needs of Australia;
- We need to raise the privacy awareness of organisations and individuals. Those recommendations, if implemented, would form the ''lynch pin'' of an improved privacy scheme that would benefit individuals while recognising the right of businesses to achieve their objectives in an efficient way;
- Consumer control over personal information should be enhanced. I have recommended that the control that individuals have over their personal information be strengthened, particularly in relation to information collected about them indirectly or used or disclosed for other purposes such as direct marketing. Simple steps that could be taken to make this happen include measures to promote clearer and more easily understood privacy notices and a general opt-out right for all direct marketing approaches;
- While retaining the small business exemption with an amendment to simplify its application, I''ve suggested that some small business sectors that handle large volumes of personal information, such as internet service providers and tenancy data base operators, for example, should be covered by the private sector provisions;
- 30 recommendations in the report relate to my Office and these include improving the transparency of the complaints process and to enable the Office to better identify and address systemic issues;
- Because of their complexity, the issue of privacy and research, in particular medical research, and privacy and new technologies warrant further debate. The main recommendation on these issues is that they should be considered in the context of a wider review of the Privacy Act.
So we found that the private sector provisions have met their objectives in some areas but not in two: meeting international concerns and the achievement of national consistency of privacy regulation.
I want to outline some of the key thoughts of business about good privacy being good business. Coles Myer, one of our largest retailers said in its submission that:
Coles Myer, like many businesses, views good privacy practices as good business. It makes no sense to communicate to customers who do not want it.
While it is fair to say that most submissions from business focused on the costs of compliance rather than the benefits, some however, acknowledged that there are benefits. A confidential submission said that the benefits are not commercial, but intangible, for example, increased standing with customers who become confident that the business will deal ethically with their personal information. In a similar vein, the Fundraising Institute Australia Ltd, states that the benefits, community confidence and trust in the industry, outweigh the costs. Telstra agrees:
''The significant financial cost to Telstra in taking steps to comply with the Privacy Act has been offset by the value to Telstra of the improved systems and processes and from a brand perspective.''
Coles Myer Ltd says that the costs outweigh the benefits to customers, while acknowledging that a simple cost benefits analysis fails to recognise the value of brand equity or public reputation, in which major companies invest heavily.
A major recommendation was that the Government should consider undertaking a wider review of privacy laws in Australia to ensure that in the 21st century the legislation best serves the needs of Australia. It had become apparent to me in the review process that while the private sector provisions work well, perhaps we should take stock. The National Privacy Principles are based on principles developed in the 1970s and it is appropriate to consider how the operating environment has changed over the last 30 years. For example: is our definition of personal information still appropriate given technological advances?
Do we need different sets of privacy principles covering the private and public sectors? In a changed security environment what are people''s expectations about their personal information?
I am pleased that on 31 January 2006, the Attorney General announced that the Australian Law Reform Commission will review the Privacy Act 1988 and report by 31 March 2008. The review will examine existing Commonwealth, state and territory laws and practices and will consider the needs of individuals in light of evolving technology, will examine current and emerging international law and consider community perceptions of privacy and the extent to which it should be protected by legislation.
Three key messages
So, I return again to the three compelling reasons as to why good privacy is good business. The three reasons are:
- Brand Damage;
- Preventing customer and business partner attrition; and
- The value of information.
Brand damage: no organisation would want to find itself like DoubleClick as the lead news item on the 6 o''clock news or the front page of a major daily newspaper for violating their customers'' privacy.
Modern organisational leaders know how important their brand/organisation reputation is among their clients and business partners and they work very hard to ensure that their brand stays in high regard. In the Australian context, Coles Myer is a good example of this and it has had only a handful of complaints about the way it deals with its customers'' personal information.
The second major reason why good privacy is good business is preventing customer and business partner attrition. Note the example of ChoicePoint. No business can afford to lose major business clients or numerous customers. Serious privacy breaches can and do lead to organisations losing customers, market share and business partners.
Now I would like to talk more about the third reason, that is, the value of information.
Good quality data or information is the lifeblood of modern organisations. Having good privacy and security measures in place builds trust between organisations, businesses and individuals. No business or individual wants to hand over information to organisations that cannot be trusted with it. Information has a high business value.
In a recent editorial in CIO Magazine, Allan Homes makes some interesting points. He said:
Privacy policies that strictly protect customers'' personal data may seem draconianâ€¦ but good privacy polices are not a dam. They are more like finely tuned control valves that direct the flow of information where customers'' - along with company executives - want it to flow for the best outcome. That''s why good privacy practitioners follow the first rule of valuing the information they have - figuring out what the information is worth to them in helping them to meet specific goals - versus protecting that information so that others cannot view it or abuse it.
To an individual, the key markers of success are control and trust.
A personal information management system is successful to the extent that the individuals whose personal information is "managed" retain appropriate degrees of control over what is personal to them. One of the best ways to place a value on personal information is to let the customer decide the value of it.
From the perspective of organisations, the key markers are trust and efficient data management.
Organisations have a successful personal information management system when they trust the data they hold, and trust the individuals and other organisations with which they deal.
Organisations can also measure their personal information management systems in terms of efficient data management. A personal information management system that collects more information than required, and collects it in a form that is easily linkable to other data, will find itself with increased data security risks and greater data management headaches.
If important identity information, and authentication of identity information, is collected and stored, then that data will be a valuable commodity that needs to be protected. A high integrity database of lots of information all stored in an easily usable form, would be a significant target, as it could be an excellent source for identity theft. The collection of too much data, arising from excessive identity management solutions, thus can create unnecessary data management headaches.
Where to from here
In my review, the private sector has asked for an integrated education and awareness campaign to be better help it comply with the legislation and to better comprehend the value of good privacy practice to their business outcomes. I hope the Government will respond positively to this recommendation.
As business increasingly recognises the business advantages of engaging in privacy-friendly practices, it is likely that they will do even more to regulate their own behaviour in this area. In the words of the former Privacy Commissioner of Canada and privacy consultant, Bruce Phillips:
''The largest and most important part of privacy work is education and understanding, particularly when you''re dealing with institutions that have been in business for a long period of time and have developed a set of business practices tailored to their own particular needs.''
We are in the information age. Information is now considered the life blood of most organisations. Without the right information in the right place at the right time most organisations would grind to a halt, and so would our societies.
Increasingly, this information relates to individuals. Ten years ago businesses couldn''t and didn''t collect ''incidental'' data about their customers. Today with new technologies, powerful database software and huge data warehouses, it''s possible to collect, store, use and transmit information about individuals to and from anywhere in the world.
Consumers know this. People understand that their personal information is being used in new ways and they are increasingly worried about what happens to that information.
The results of research conducted by Roy Morgan for my Office, during 2004, found that when using the internet, 62% of internet users have more concerns about the security of their personal details than usual, this is up from 57% in 2001 survey. Consistent with these findings, 67% reported having more concerns than was the case two years ago.
When asked if they thought the following were privacy invasions, 93% of people said yes. The scenarios included:
- a business that you don't know gets hold of your personal information (94%).
- a business monitors your activities on the internet, recording information on the sites you visit without your knowledge (93%).
- you supply your information to a business for a specific purpose and the business uses it for another purpose (93%).
- a business asks you for personal information that doesn't seem relevant to the purpose of the transaction (94%).
All organisations that collect personal information need to be aware of what their customers want. Numerous organisations and individuals are out there watching and telling others about privacy breaches. I''ll mention just a few:
- Privacy Rights clearing house @ http://www.privacyrights.org/ar/ChronDataBreaches.htm
- Privacy Today @ http://www.privacytoday.com/
- Privacy Spot @ http://privacyspot.com/
- Politics of Privacy Blog @ http://politicsofprivacy.blogspot.com/
- Privacy and Security Law Blog @ http://www.privsecblog.com/archives/federal-legislation-31-congress-considers-security-breach-and-data-security-bills.html
- Schneier Blog @ http://www.schneier.com/blog/archives/2005/12/doj_privacy_bre.html
- Emergent Chaos Blog @ http://www.emergentchaos.com/archives/cat_breaches.html
Broadly speaking, with the private sector provisions, the approach taken by my Office to generate a culture in Australia that respects privacy was to inculcate privacy values in business first. The best strategy for my office as a small agency, was to work with the private sector to initiate change. Indeed, it is through businesses making privacy part of the business process that the biggest changes in culture will occur.
Increasingly, there is a push to demonstrate the business advantage to engaging in good privacy practices. In their book The Privacy Payoff: How Successful Businesses Build Customer Trust, Ann Cavoukian and Tyler J. Hamilton outline the importance of safe privacy practices for business, especially in the rapidly growing Internet marketplace:
As awareness of privacy builds, any company that doesn''t treat privacy as a core business issue will find itself at a disadvantage in the Internet marketplace. Its customers will have more reason to abandon their loyalties and will be less likely to buy its products.
These same customers will be more inclined to seek out competitors who can give them the control they desire and increasingly demand over their personal information. Ignoring privacy reflects negatively on a company''s brand, which, in a society of networked consumers who are increasingly savvy about privacy issues, can fall out of favour literally overnight.
I''m sure that the following privacy blunders could have been avoided if the organisations involved had better privacy awareness among all staff.
A world-renowned hospital has been mistakenly faxing confidential patient information '' including the results of tests for sexually transmitted diseases '' to a Boston investment bank despite repeated attempts by the bank to stop it. 
On 26 January 2006 a courier vehicle owned by MediTran Services Ltd (was stolen). The vehicle, containing hundreds of medical records, was left unlocked and running outside a medical building in Langley. The Privacy Commissioner is investigating the incident.
The Boston Globe and Worcester Telegram & Gazette mistakenly sent out slips of paper with the credit card data of up to nearly a quarter million subscribers. The credit card numbers were printed on routing slips attached to 9,000 bundles of newspapers sent to retailers and carriers â€¦ according to the two Massachusetts newspapers owned by the New York Times Co.
I''m sure that the organisations just mentioned all have the appropriate privacy policies written down somewhere but it''s clear the privacy awareness has not become ingrained among all people in the organisation. It needs to become as second nature, as say, not being rude to customers.
Practical steps that organisations can take to promote privacy so it becomes imbedded in business practices include:
- Ensure privacy becomes an issue for the leaders of the organisation. It needs to be reported on and monitored by the Board or a Board Committee;
- Appoint a Chief Privacy Officer with access to the leadership of an organisation and establish a cross-organisation privacy team;
- Conduct a privacy audit and act on its finding
- Awareness of privacy should be built into the culture of an organisation;
- Develop layered privacy notices;
- Develop privacy policies;
- Provide privacy training modules to all staff, regularly;
- Include privacy performance as part of employee performance review;
- Undertake Privacy Impact Assessments when undertaking any major work dealing with personal information;
The bottom line is that privacy should be part of executive decisions about new products, services or internal use of customer information, so it becomes ingrained in the corporate culture.
In my estimation, good privacy is good business. Many Australian businesses are performing well in the privacy stakes as they have recognised the importance of handling their customers'' information appropriately. I expect overall performance will even improve further as their understanding develops. The privacy journey is still relatively new.
I look forward to the day when my office can move to the next slogan - best privacy is best business.
Going back to the world tables, I note that I neglected the one, make that two, that matter the most - rugby and netball.
I salute New Zealand as a world leader in privacy as well, and I look forward to being part of today''s forum.
 Privacy Amendment (Private Sector) Bill 2000 second reading Speech House of Representatives Hansard, 8 November 2000, p 22370
 Office of the Privacy Commissioner, The Review of the Private Sector Provisions of the Privacy Act, March 2005, p 165
 Computer World: DoubleClick Settlement May Affect Corporate IT Policies @ http://www.computerworld.com/securitytopics/security/privacy/story/0,10801,69926,00.html
The Privacy Payoff, Cavoukian A and Hamilton, T.J, pg 24
 Time Australia, 7 March 2005 ''Are your secrets safe:'' http://www.time.com/time/archive/preview/0,10987,1032374,00.html
 ChoicePoint fined $15m over data security breach: http://www.theregister.co.uk/2006/01/27/choicepoint_ftc_settlement/
 ChoicePoint recovery: http://www.tmcnet.com/usubmit/2006/02/13/1367773.htm
 ChoicePoint fined $15m over data security breach: http://www.theregister.co.uk/2006/01/27/choicepoint_ftc_settlement/
 ChoicePoint recovery: http://www.tmcnet.com/usubmit/2006/02/13/1367773.htm
 ChoicePoint fined $15m over data security breach: http://www.theregister.co.uk/2006/01/27/choicepoint_ftc_settlement/
 Yahoo, CHOICEPOINT INC (NYSE) http://uk.finance.yahoo.com/q/bc?s=CPS&t=6m&l=on&z=m&q=l&c=
A Chronology of Data Breaches Reported Since the ChoicePoint Incident : http://www.privacyrights.org/ar/ChronDataBreaches.htm
 Security breach may have exposed 40M credit cards : http://www.computerworld.com/securitytopics/security/story/0,10801,102631,00.html
 Visa, Amex cut ties with processing firm hit by security breach : http://www.computerworld.com/industrytopics/financial/story/0,10801,103352,00.html
 ''CardSystems says it faces ''imminent extinction'', Reuters, News.com, 22 July 2005.
 Court orders CardSystems to retain breach information: http://www.computerworld.com/securitytopics/security/privacy/story/0,10801,103666,00.html
 Consumers punish firms over data security breaches: http://www.theregister.co.uk/2005/11/15/data_security_breach_survey/
Privacy and the Community prepared for the Office of the Privacy Commissioner by Roy Morgan Research, July 2001, p7.
 Your Money and Your Life: http://www.abc.net.au/4corners/content/2005/s1435556.htm
 Transcript of Quentin McDermott's report into cyber-fraud, "Your Money and Your Life": http://www.abc.net.au/4corners/content/2005/s1438338.htm
 See Submission 60, Coles Myer
 Office of the Privacy Commissioner, The Review of the Private Sector Provisions of the Privacy Act, March 2005, p 174
 Office of the Privacy Commissioner, Review of the Private Sector Provisions, March 2005, p 174
Quoted in The Privacy Payoff, Cavoukian A and Hamilton, T.J, op.cit, p120
The Privacy Payoff, ibid., p92.
 Brigham sent bank new moms'' records: http://news.bostonherald.com/localRegional/view.bg?articleid=124753
 Medical Files Stolen: http://www.castanet.net/edition/news-story-15859--search.htm
 A Privacy Impact Assessment (PIA) is an assessment tool that describes, in detail, the personal information flows in a project, and assesses the privacy risks a project may pose. The purpose of a PIA is to gain an understanding of, and to minimise, any adverse impacts a project may have on the privacy of individuals. A PIA may do this for example, by helping to identify when collection of particular information is unnecessary to a project, or where accountability or oversight processes may reduce privacy risks. It enables and organisation to:
- describe fully and systematically, the way personal information ''flows'' in the project;
- analyse how these information flows will impact on privacy;
- consider alternative, less privacy-intrusive practices;
- assess and manage privacy risks during project development rather than retrospectively;
- identify early, a project''s potential for further privacy erosion, for example, through ''function creep'' (additional uses of a system, and/or the personal information it involves, beyond the original plans or expectations); and
- make informed choices about how the project will proceed.