The Privacy Payoff: How Successful Business Build Customer Trust [Hardcover]

If the title had been privacy anecdotes, reflections and interviews: a mile wide and an inch deep, the book would warrant a higher rating. But with a title of such titillating promise and the hyperbole of the editorial reviews: one doubts Alvin Toffler got past the first few pages, the book is a betrayal in the harshest way.

Sculpted from the light privacy 101 retread presentation. The book has become a conference bag stuffer only when one of the authors give a key not address. As one former head of government bemoaned, "Will the book tour never end?" Why? Because the book refuses to become the aid de camp it intimates at being.

One would be hard pressed to find a senior executive turning to this extended slide show to aid in his strategic investment decisions regarding privacy. But at least one should rate it higher for its sense of harmlessness.

This is perhaps where its cosy warmth of style could redeem it. But no, the sedulous aping of private sector vocabulary, creates an uncomplimentary caricature. The incessant use of the 'bottom line' as a tag line for what should be some pith and insight resulting from some hard analysis is only a paper thin Power Point slide of bullet points, dangling at the end of the chapters.

No the book is not harmless, because it is misleading in its simple, polly anna approach to privacy. In the end it is full of platitudes and truisms that have no real substance. The book takes on the form of an aging, dolled up cheerleader on the edge of pool of quicksand. The cheers have become worn and the reader realizes too late that there is no helping hand out of the chaos as the cheerleader promises, just more cheers from the sidelines.

As one sinks into the quagmire the last cheer one hears is 'Privacy is Good for Business' Like the critic of the endless book tour, finding no hand to hold on to one is thank-ful for the quicksand for bringing an end to hearing another refrain.

Privacy Pays is an indispensable reference for anyone concerned with privacy issues. It contains a cogent analysis of the threats to individuals and corporations posed by modern information technology as well as an appraisal of regulatory solutions. The book offers compelling and practical advice for organizations that seek to protect the privacy of employees and customers and clearly demonstrates how doing so can enhance the bottom line. The Action Plan for Business alone is well worth the price of the book.

Make space on your bookshelf for The PRIVACY PAYOFF: How Successful Businesses Build Customer Trust, a valuable new business primer on privacy by Ann Cavoukian and Tyler Hamilton. Cavoukian is the Information and Privacy Commissioner of Ontario and co-author of a previous book on privacy entitled Who Knows: safeguarding your privacy in a networked world. Hamilton is a business reporter and technology columnist at the Toronto Star who has covered consumer privacy issues extensively.
While Cavoukian's first book was consumer-oriented, this book is aimed at the small to medium business market, providing an excellent insight into the importance of good privacy practices.
In 12 chapters, this 300 page plus book addresses the significance of good data protection as a leading business issue (stating unequivocally that heightened post 9-11 government security concerns have absolutely nothing to do with the business need to address consumer privacy).
Chapters 3 and 4 address the fundamental concepts of privacy and the development of fair information practices or FIPS, with an explanation of how these FIPs have been translated into various codes (OECD, CSA and the FTC's "Big Four"). Chapter 4 goes on to describe the global regulatory environment, including the development of the EU Directive and the impacts of article 25 (adequacy of non EU-nation data protection), as well as the development of PIPEDA and the U.S. Safe Harbor arrangement. Other key U.S. privacy laws are also briefly summarized and there is a short comment on Asia/Pacific privacy legislation.
Chapter 5 looks at the need for business to take a comprehensive approach to privacy implementation beginning with a privacy diagnosis. Some tools are highlighted that businesses can use to assess their own current level of privacy principles compliance and shortcomings, including a Privacy Risk Assessment Test developed by Forrester Research Inc.
Some readers of this book may turn to chapter 6 first where the authors include profiles on six Chief Privacy Officers (five U.S.) including IBM's Harriet Pearson and Peter Cullen of the RBC Financial Group, who reports a 50 percent drop in privacy complaints since RBC committed to a high profile approach to privacy protection to maintain customer trust and achieve competitive differentiation. Jules Polonetsky of DoubleClick, which has had a roller-coaster ride of privacy problems, Kirk Herath of Nationwide Insurance Companies, Zoe Strickland of the US Postal Service, and Oliver Johnson of Merck & Co. are also profiled. All of the CPOs offer useful advice on the processes of privacy management within large and diversified organizations - see especially Zoe Strickland's five-point list.
Chapter 7 covers safeguards leaks, glitches and breaches with descriptions of viruses, worms and Trojan Horses, first-hand evidence on the perils of unsecured wireless networks, and a bottom-line comment that "sorry isn't enough."
In Chapter 8, the authors focus on consumer worries about digital data shadows, solutions to the cookies problem, the privacy risks of biometrics, satellite tracking, electronic tags, interactive TV, and other similar devices, and the growing, in fact alarming, increase in identity theft.
Chapters 9 and 10 cover the impacts of such consumer fears on marketing activities and the big issue of workplace privacy (there are excellent tips for employers on pages 247-249).
Chapter 11 covers technologies that can be used to enhance privacy (an ongoing focus of the Ontario Commissioner) and chapter 12 concludes with very practical advice on a privacy action plan for business. The "Top 25 Tips for Privacy Payoff" list is useful and practical.
This book is well researched and any observations and conclusions made by the authors are well-supported by factual detail and analysis. If there is any criticism of this book for a Canadian reader it is the orientation towards the U.S. marketplace as a source of research, examples of privacy issues, CPO profiles, and in some cases, even legislation. For example, a discussion of workplace privacy law starts off with a discussion of the U.S. Electronic Communications Privacy Act. It is only two pages later that Canada's private sector privacy law and its effect on workplace surveillance is briefly mentioned. While the authors cannot be faulted in aiming their book at the larger market of U.S. corporations (their publisher, McGraw-Hill, owner of Standard & Poor's and Business Week, is one of the world's biggest business publishing houses), and U.S. privacy mistakes by business tend to have far more dramatic impacts, more Canadian focussed content would have been desirable.
Nevertheless, this is an excellent primer for any business reader seeking to understand the broad issues of privacy protection in the commercial world and the business imperative to implement a thorough and cohesive privacy program. The practical advice in Chapter 12 alone makes the book worth every cent. For readers interested in Ann Cavoukian's views on opt in and opt-out consent, the book is also worth the money.

Murray Long, Canadian privacy consultant and journalist
N.B. This review taken from my electronic privacy newsletter